code:
/*
 * Copyright (C) 1993-2001, 2003 by Darren Reed.
 *
 * See the IPFILTER.LICENCE file for details on licencing.
 *
 * @(#)ip_fil.h	1.35 6/5/96
 * $FreeBSD: release/9.0.0/sys/contrib/ipfilter/netinet/ip_fil.h 180778 2008-07-24 12:35:05Z darrenr $
 * Id: ip_fil.h,v 2.170.2.51 2007/10/10 09:48:03 darrenr Exp $
 */

#ifndef	__IP_FIL_H__
#define	__IP_FIL_H__

#include "netinet/ip_compat.h"

#ifndef	SOLARIS
# define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
#endif

#ifndef	__P
# ifdef	__STDC__
#  define	__P(x)	x
# else
#  define	__P(x)	()
# endif
#endif

#if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
# define	SIOCADAFR	_IOW('r', 60, struct ipfobj)
# define	SIOCRMAFR	_IOW('r', 61, struct ipfobj)
# define	SIOCSETFF	_IOW('r', 62, u_int)
# define	SIOCGETFF	_IOR('r', 63, u_int)
# define	SIOCGETFS	_IOWR('r', 64, struct ipfobj)
# define	SIOCIPFFL	_IOWR('r', 65, int)
# define	SIOCIPFFB	_IOR('r', 66, int)
# define	SIOCADIFR	_IOW('r', 67, struct ipfobj)
# define	SIOCRMIFR	_IOW('r', 68, struct ipfobj)
# define	SIOCSWAPA	_IOR('r', 69, u_int)
# define	SIOCINAFR	_IOW('r', 70, struct ipfobj)
# define	SIOCINIFR	_IOW('r', 71, struct ipfobj)
# define	SIOCFRENB	_IOW('r', 72, u_int)
# define	SIOCFRSYN	_IOW('r', 73, u_int)
# define	SIOCFRZST	_IOWR('r', 74, struct ipfobj)
# define	SIOCZRLST	_IOWR('r', 75, struct ipfobj)
# define	SIOCAUTHW	_IOWR('r', 76, struct ipfobj)
# define	SIOCAUTHR	_IOWR('r', 77, struct ipfobj)
# define	SIOCSTAT1	_IOWR('r', 78, struct ipfobj)
# define	SIOCSTLCK	_IOWR('r', 79, u_int)
# define	SIOCSTPUT	_IOWR('r', 80, struct ipfobj)
# define	SIOCSTGET	_IOWR('r', 81, struct ipfobj)
# define	SIOCSTGSZ	_IOWR('r', 82, struct ipfobj)
# define	SIOCSTAT2	_IOWR('r', 83, struct ipfobj)
# define	SIOCSETLG	_IOWR('r', 84, int)
# define	SIOCGETLG	_IOWR('r', 85, int)
# define	SIOCFUNCL	_IOWR('r', 86, struct ipfunc_resolve)
# define	SIOCIPFGETNEXT	_IOWR('r', 87, struct ipfobj)
# define	SIOCIPFGET	_IOWR('r', 88, struct ipfobj)
# define	SIOCIPFSET	_IOWR('r', 89, struct ipfobj)
# define	SIOCIPFL6	_IOWR('r', 90, int)
# define	SIOCIPFITER	_IOWR('r', 91, struct ipfobj)
# define	SIOCGENITER	_IOWR('r', 92, struct ipfobj)
# define	SIOCGTABL	_IOWR('r', 93, struct ipfobj)
# define	SIOCIPFDELTOK	_IOWR('r', 94, int)
# define	SIOCLOOKUPITER	_IOWR('r', 95, struct ipfobj)
# define	SIOCGTQTAB	_IOWR('r', 96, struct ipfobj)
#else
# define	SIOCADAFR	_IOW(r, 60, struct ipfobj)
# define	SIOCRMAFR	_IOW(r, 61, struct ipfobj)
# define	SIOCSETFF	_IOW(r, 62, u_int)
# define	SIOCGETFF	_IOR(r, 63, u_int)
# define	SIOCGETFS	_IOWR(r, 64, struct ipfobj)
# define	SIOCIPFFL	_IOWR(r, 65, int)
# define	SIOCIPFFB	_IOR(r, 66, int)
# define	SIOCADIFR	_IOW(r, 67, struct ipfobj)
# define	SIOCRMIFR	_IOW(r, 68, struct ipfobj)
# define	SIOCSWAPA	_IOR(r, 69, u_int)
# define	SIOCINAFR	_IOW(r, 70, struct ipfobj)
# define	SIOCINIFR	_IOW(r, 71, struct ipfobj)
# define	SIOCFRENB	_IOW(r, 72, u_int)
# define	SIOCFRSYN	_IOW(r, 73, u_int)
# define	SIOCFRZST	_IOWR(r, 74, struct ipfobj)
# define	SIOCZRLST	_IOWR(r, 75, struct ipfobj)
# define	SIOCAUTHW	_IOWR(r, 76, struct ipfobj)
# define	SIOCAUTHR	_IOWR(r, 77, struct ipfobj)
# define	SIOCSTAT1	_IOWR(r, 78, struct ipfobj)
# define	SIOCSTLCK	_IOWR(r, 79, u_int)
# define	SIOCSTPUT	_IOWR(r, 80, struct ipfobj)
# define	SIOCSTGET	_IOWR(r, 81, struct ipfobj)
# define	SIOCSTGSZ	_IOWR(r, 82, struct ipfobj)
# define	SIOCSTAT2	_IOWR(r, 83, struct ipfobj)
# define	SIOCSETLG	_IOWR(r, 84, int)
# define	SIOCGETLG	_IOWR(r, 85, int)
# define	SIOCFUNCL	_IOWR(r, 86, struct ipfunc_resolve)
# define	SIOCIPFGETNEXT	_IOWR(r, 87, struct ipfobj)
# define	SIOCIPFGET	_IOWR(r, 88, struct ipfobj)
# define	SIOCIPFSET	_IOWR(r, 89, struct ipfobj)
# define	SIOCIPFL6	_IOWR(r, 90, int)
# define	SIOCIPFITER	_IOWR(r, 91, struct ipfobj)
# define	SIOCGENITER	_IOWR(r, 92, struct ipfobj)
# define	SIOCGTABL	_IOWR(r, 93, struct ipfobj)
# define	SIOCIPFDELTOK	_IOWR(r, 94, int)
# define	SIOCLOOKUPITER	_IOWR(r, 95, struct ipfobj)
# define	SIOCGTQTAB	_IOWR(r, 96, struct ipfobj)
#endif
#define	SIOCADDFR	SIOCADAFR
#define	SIOCDELFR	SIOCRMAFR
#define	SIOCINSFR	SIOCINAFR
#define	SIOCATHST	SIOCSTAT1
#define	SIOCGFRST	SIOCSTAT2

struct ipscan;
struct ifnet;

typedef	int	(* lookupfunc_t) __P((void *, int, void *));

/*
 * i6addr is used as a container for both IPv4 and IPv6 addresses, as well
 * as other types of objects, depending on its qualifier.
 */
#ifdef	USE_INET6
typedef	union	i6addr	{
	u_32_t	i6[4];
	struct	in_addr	in4;
	struct	in6_addr in6;
	void	*vptr[2];
	lookupfunc_t	lptr[2];
	struct {
		u_short	type;
		u_short	subtype;
		char	label[12];
	} i6un;
} i6addr_t;
#else
typedef	union	i6addr	{
	u_32_t	i6[4];
	struct	in_addr	in4;
	void	*vptr[2];
	lookupfunc_t	lptr[2];
	struct {
		u_short	type;
		u_short	subtype;
		char	label[12];
	} i6un;
} i6addr_t;
#endif

#define in4_addr	in4.s_addr
#define	iplookupnum	i6[1]
#define	iplookupname	i6un.label
#define	iplookuptype	i6un.type
#define	iplookupsubtype	i6un.subtype
/*
 * NOTE: These DO overlap the above on 64bit systems and this IS recognised.
 */
#define	iplookupptr	vptr[0]
#define	iplookupfunc	lptr[1]

#define	I60(x)	(((u_32_t *)(x))[0])
#define	I61(x)	(((u_32_t *)(x))[1])
#define	I62(x)	(((u_32_t *)(x))[2])
#define	I63(x)	(((u_32_t *)(x))[3])
#define	HI60(x)	ntohl(((u_32_t *)(x))[0])
#define	HI61(x)	ntohl(((u_32_t *)(x))[1])
#define	HI62(x)	ntohl(((u_32_t *)(x))[2])
#define	HI63(x)	ntohl(((u_32_t *)(x))[3])

#define	IP6_EQ(a,b)	((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
			 (I61(a) == I61(b)) && (I60(a) == I60(b)))
#define	IP6_NEQ(a,b)	((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
			 (I61(a) != I61(b)) || (I60(a) != I60(b)))
#define IP6_ISZERO(a)   ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
#define IP6_NOTZERO(a)  ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
#define	IP6_GT(a,b)	(HI60(a) > HI60(b) || (HI60(a) == HI60(b) && \
			  (HI61(a) > HI61(b) || (HI61(a) == HI61(b) && \
			    (HI62(a) > HI62(b) || (HI62(a) == HI62(b) && \
			      HI63(a) > HI63(b)))))))
#define	IP6_LT(a,b)	(HI60(a) < HI60(b) || (HI60(a) == HI60(b) && \
			  (HI61(a) < HI61(b) || (HI61(a) == HI61(b) && \
			    (HI62(a) < HI62(b) || (HI62(a) == HI62(b) && \
			      HI63(a) < HI63(b)))))))
#define	NLADD(n,x)	htonl(ntohl(n) + (x))
#define	IP6_INC(a)	\
		{ u_32_t *_i6 = (u_32_t *)(a); \
		  _i6[3] = NLADD(_i6[3], 1); \
		  if (_i6[3] == 0) { \
			_i6[2] = NLADD(_i6[2], 1); \
			if (_i6[2] == 0) { \
				_i6[1] = NLADD(_i6[1], 1); \
				if (_i6[1] == 0) { \
					_i6[0] = NLADD(_i6[0], 1); \
				} \
			} \
		  } \
		}
#define	IP6_ADD(a,x,d)	\
		{ i6addr_t *_s = (i6addr_t *)(a); \
		  i6addr_t *_d = (i6addr_t *)(d); \
		  _d->i6[0] = NLADD(_s->i6[0], x); \
		  if (ntohl(_d->i6[0]) < ntohl(_s->i6[0])) { \
			_d->i6[1] = NLADD(_d->i6[1], 1); \
			if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
				_d->i6[2] = NLADD(_d->i6[2], 1); \
				if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
					_d->i6[3] = NLADD(_d->i6[3], 1); \
				} \
			} \
		  } \
		}
#define	IP6_AND(a,b,d)	{ i6addr_t *_s1 = (i6addr_t *)(a); \
			  i6addr_t *_s2 = (i6addr_t *)(d); \
			  i6addr_t *_d = (i6addr_t *)(d); \
			  _d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
			  _d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
			  _d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
			  _d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
			}
#define	IP6_MERGE(a,b,c) \
			{ i6addr_t *_d, *_s1, *_s2; \
			  _d = (i6addr_t *)(a); \
			  _s1 = (i6addr_t *)(b); \
			  _s2 = (i6addr_t *)(c); \
			  _d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
			  _d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
			  _d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
			  _d->i6[2] |= _s1->i6[3] & ~_s2->i6[3]; \
			}

typedef	struct	fr_ip	{
	u_32_t	fi_v:4;		/* IP version */
	u_32_t	fi_xx:4;	/* spare */
	u_32_t	fi_tos:8;	/* IP packet TOS */
	u_32_t	fi_ttl:8;	/* IP packet TTL */
	u_32_t	fi_p:8;		/* IP packet protocol */
	u_32_t	fi_optmsk;	/* bitmask composed from IP options */
	i6addr_t fi_src;	/* source address from packet */
	i6addr_t fi_dst;	/* destination address from packet */
	u_short	fi_secmsk;	/* bitmask composed from IP security options */
	u_short	fi_auth;	/* authentication code from IP sec. options */
	u_32_t	fi_flx;		/* packet flags */
	u_32_t	fi_tcpmsk;	/* TCP options set/reset */
	u_32_t	fi_res1;	/* RESERVED */
} fr_ip_t;

/*
 * For use in fi_flx
 */
#define	FI_TCPUDP	0x0001	/* TCP/UCP implied comparison*/
#define	FI_OPTIONS	0x0002
#define	FI_FRAG		0x0004
#define	FI_SHORT	0x0008
#define	FI_NATED	0x0010
#define	FI_MULTICAST	0x0020
#define	FI_BROADCAST	0x0040
#define	FI_MBCAST	0x0080
#define	FI_STATE	0x0100
#define	FI_BADNAT	0x0200
#define	FI_BAD		0x0400
#define	FI_OOW		0x0800	/* Out of state window, else match */
#define	FI_ICMPERR	0x1000
#define	FI_FRAGBODY	0x2000
#define	FI_BADSRC	0x4000
#define	FI_LOWTTL	0x8000
#define	FI_CMP		0xcf03	/* Not FI_FRAG,FI_NATED,FI_FRAGTAIL,broadcast */
#define	FI_ICMPCMP	0x0003	/* Flags we can check for ICMP error packets */
#define	FI_WITH		0xeffe	/* Not FI_TCPUDP */
#define	FI_V6EXTHDR	0x10000
#define	FI_COALESCE	0x20000
#define	FI_NEWNAT	0x40000
#define	FI_NOCKSUM	0x20000000	/* don't do a L4 checksum validation */
#define	FI_DONTCACHE	0x40000000	/* don't cache the result */
#define	FI_IGNORE	0x80000000

#define	fi_saddr	fi_src.in4.s_addr
#define	fi_daddr	fi_dst.in4.s_addr
#define	fi_srcnum	fi_src.iplookupnum
#define	fi_dstnum	fi_dst.iplookupnum
#define	fi_srcname	fi_src.iplookupname
#define	fi_dstname	fi_dst.iplookupname
#define	fi_srctype	fi_src.iplookuptype
#define	fi_dsttype	fi_dst.iplookuptype
#define	fi_srcsubtype	fi_src.iplookupsubtype
#define	fi_dstsubtype	fi_dst.iplookupsubtype
#define	fi_srcptr	fi_src.iplookupptr
#define	fi_dstptr	fi_dst.iplookupptr
#define	fi_srcfunc	fi_src.iplookupfunc
#define	fi_dstfunc	fi_dst.iplookupfunc

/*
 * These are both used by the state and NAT code to indicate that one port or
 * the other should be treated as a wildcard.
 * NOTE: When updating, check bit masks in ip_state.h and update there too.
 */
#define	SI_W_SPORT	0x00000100
#define	SI_W_DPORT	0x00000200
#define	SI_WILDP	(SI_W_SPORT|SI_W_DPORT)
#define	SI_W_SADDR	0x00000400
#define	SI_W_DADDR	0x00000800
#define	SI_WILDA	(SI_W_SADDR|SI_W_DADDR)
#define	SI_NEWFR	0x00001000
#define	SI_CLONE	0x00002000
#define	SI_CLONED	0x00004000

typedef	struct	fr_info	{
	void	*fin_ifp;		/* interface packet is `on' */
	fr_ip_t	fin_fi;		/* IP Packet summary */
	union	{
		u_short	fid_16[2];	/* TCP/UDP ports, ICMP code/type */
		u_32_t	fid_32;
	} fin_dat;
	int	fin_out;		/* in or out ? 1 == out, 0 == in */
	int	fin_rev;		/* state only: 1 = reverse */
	u_short	fin_hlen;		/* length of IP header in bytes */
	u_char	fin_tcpf;		/* TCP header flags (SYN, ACK, etc) */
	u_char	fin_icode;		/* ICMP error to return */
	u_32_t	fin_rule;		/* rule # last matched */
	char	fin_group[FR_GROUPLEN];	/* group number, -1 for none */
	struct	frentry *fin_fr;	/* last matching rule */
	void	*fin_dp;		/* start of data past IP header */
	int	fin_dlen;		/* length of data portion of packet */
	int	fin_plen;
	int	fin_ipoff;		/* # bytes from buffer start to hdr */
	u_short	fin_id;			/* IP packet id field */
	u_short	fin_off;
	int	fin_depth;		/* Group nesting depth */
	int	fin_error;		/* Error code to return */
	int	fin_cksum;		/* -1 bad, 1 good, 0 not done */
	void	*fin_nat;
	void	*fin_state;
	void	*fin_nattag;
	void	*fin_exthdr;
	ip_t	*fin_ip;
	mb_t	**fin_mp;		/* pointer to pointer to mbuf */
	mb_t	*fin_m;			/* pointer to mbuf */
#ifdef	MENTAT
	mb_t	*fin_qfm;		/* pointer to mblk where pkt starts */
	void	*fin_qpi;
	char	fin_ifname[LIFNAMSIZ];
#endif
#ifdef	__sgi
	void	*fin_hbuf;
#endif
} fr_info_t;

#define	fin_v		fin_fi.fi_v
#define	fin_p		fin_fi.fi_p
#define	fin_flx		fin_fi.fi_flx
#define	fin_optmsk	fin_fi.fi_optmsk
#define	fin_secmsk	fin_fi.fi_secmsk
#define	fin_auth	fin_fi.fi_auth
#define	fin_src		fin_fi.fi_src.in4
#define	fin_src6	fin_fi.fi_src.in6
#define	fin_saddr	fin_fi.fi_saddr
#define	fin_dst		fin_fi.fi_dst.in4
#define	fin_dst6	fin_fi.fi_dst.in6
#define	fin_daddr	fin_fi.fi_daddr
#define	fin_data	fin_dat.fid_16
#define	fin_sport	fin_dat.fid_16[0]
#define	fin_dport	fin_dat.fid_16[1]
#define	fin_ports	fin_dat.fid_32

#define	IPF_IN		0
#define	IPF_OUT		1

typedef	struct frentry	*(*ipfunc_t) __P((fr_info_t *, u_32_t *));
typedef	int		(*ipfuncinit_t) __P((struct frentry *));

typedef	struct	ipfunc_resolve	{
	char		ipfu_name[32];
	ipfunc_t	ipfu_addr;
	ipfuncinit_t	ipfu_init;
} ipfunc_resolve_t;

/*
 * Size for compares on fr_info structures
 */
#define	FI_CSIZE	offsetof(fr_info_t, fin_icode)
#define	FI_LCSIZE	offsetof(fr_info_t, fin_dp)

/*
 * Size for copying cache fr_info structure
 */
#define	FI_COPYSIZE	offsetof(fr_info_t, fin_dp)

/*
 * Structure for holding IPFilter's tag information
 */
#define	IPFTAG_LEN	16
typedef	struct	{
	union	{
		u_32_t	iptu_num[4];
		char	iptu_tag[IPFTAG_LEN];
	} ipt_un;
	int	ipt_not;
} ipftag_t;

#define	ipt_tag	ipt_un.iptu_tag
#define	ipt_num	ipt_un.iptu_num

/*
 * This structure is used to hold information about the next hop for where
 * to forward a packet.
 */
typedef	struct	frdest	{
	void	*fd_ifp;
	i6addr_t	fd_ip6;
	char	fd_ifname[LIFNAMSIZ];
} frdest_t;

#define	fd_ip	fd_ip6.in4

/*
 * This structure holds information about a port comparison.
 */
typedef	struct	frpcmp	{
	int	frp_cmp;	/* data for port comparisons */
	u_short	frp_port;	/* top port for <> and >< */
	u_short	frp_top;	/* top port for <> and >< */
} frpcmp_t;

#define FR_NONE 0
#define FR_EQUAL 1
#define FR_NEQUAL 2
#define FR_LESST 3
#define FR_GREATERT 4
#define FR_LESSTE 5
#define FR_GREATERTE 6
#define FR_OUTRANGE 7
#define FR_INRANGE 8
#define FR_INCRANGE 9

/*
 * Structure containing all the relevant TCP things that can be checked in
 * a filter rule.
 */
typedef	struct	frtuc	{
	u_char		ftu_tcpfm;	/* tcp flags mask */
	u_char		ftu_tcpf;	/* tcp flags */
	frpcmp_t	ftu_src;
	frpcmp_t	ftu_dst;
} frtuc_t;

#define	ftu_scmp	ftu_src.frp_cmp
#define	ftu_dcmp	ftu_dst.frp_cmp
#define	ftu_sport	ftu_src.frp_port
#define	ftu_dport	ftu_dst.frp_port
#define	ftu_stop	ftu_src.frp_top
#define	ftu_dtop	ftu_dst.frp_top

#define	FR_TCPFMAX	0x3f

/*
 * This structure makes up what is considered to be the IPFilter specific
 * matching components of a filter rule, as opposed to the data structures
 * used to define the result which are in frentry_t and not here.
 */
typedef	struct	fripf	{
	fr_ip_t	fri_ip;
	fr_ip_t	fri_mip;	/* mask structure */

	u_short	fri_icmpm;		/* data for ICMP packets (mask) */
	u_short	fri_icmp;

	frtuc_t	fri_tuc;
	int	fri_satype;		/* addres type */
	int	fri_datype;		/* addres type */
	int	fri_sifpidx;		/* doing dynamic addressing */
	int	fri_difpidx;		/* index into fr_ifps[] to use when */
} fripf_t;

#define	fri_dlookup	fri_mip.fi_dst
#define	fri_slookup	fri_mip.fi_src
#define	fri_dstnum	fri_mip.fi_dstnum
#define	fri_srcnum	fri_mip.fi_srcnum
#define	fri_dstname	fri_mip.fi_dstname
#define	fri_srcname	fri_mip.fi_srcname
#define	fri_dstptr	fri_mip.fi_dstptr
#define	fri_srcptr	fri_mip.fi_srcptr

#define	FRI_NORMAL	0	/* Normal address */
#define	FRI_DYNAMIC	1	/* dynamic address */
#define	FRI_LOOKUP	2	/* address is a pool # */
#define	FRI_RANGE	3	/* address/mask is a range */
#define	FRI_NETWORK	4	/* network address from if */
#define	FRI_BROADCAST	5	/* broadcast address from if */
#define	FRI_PEERADDR	6	/* Peer address for P-to-P */
#define	FRI_NETMASKED	7	/* network address with netmask from if */

typedef	struct	frentry	* (* frentfunc_t) __P((fr_info_t *));

typedef	struct	frentry {
	ipfmutex_t	fr_lock;
	struct	frentry	*fr_next;
	struct	frentry	**fr_grp;
	struct	ipscan	*fr_isc;
	void	*fr_ifas[4];
	void	*fr_ptr;	/* for use with fr_arg */
	char	*fr_comment;	/* text comment for rule */
	int	fr_ref;		/* reference count - for grouping */
	int	fr_statecnt;	/* state count - for limit rules */
	/*
	 * The line number from a file is here because we need to be able to
	 * match the rule generated with ``grep rule ipf.conf | ipf -rf -''
	 * with the rule loaded using ``ipf -f ipf.conf'' - thus it can't be
	 * on the other side of fr_func.
	 */
	int	fr_flineno;	/* line number from conf file */
	/*
	 * These are only incremented when a packet  matches this rule and
	 * it is the last match
	 */
	U_QUAD_T	fr_hits;
	U_QUAD_T	fr_bytes;

	/*
	 * For PPS rate limiting
	 */
	struct timeval	fr_lastpkt;
	int		fr_curpps;

	union	{
		void		*fru_data;
		caddr_t		fru_caddr;
		fripf_t		*fru_ipf;
		frentfunc_t	fru_func;
	} fr_dun;

	/*
	 * Fields after this may not change whilst in the kernel.
	 */
	ipfunc_t fr_func; 	/* call this function */
	int	fr_dsize;
	int	fr_pps;
	int	fr_statemax;	/* max reference count */
	u_32_t	fr_type;
	u_32_t	fr_flags;	/* per-rule flags && options (see below) */
	u_32_t	fr_logtag;	/* user defined log tag # */
	u_32_t	fr_collect;	/* collection number */
	u_int	fr_arg;		/* misc. numeric arg for rule */
	u_int	fr_loglevel;	/* syslog log facility + priority */
	u_int	fr_age[2];	/* non-TCP timeouts */
	u_char	fr_v;
	u_char	fr_icode;	/* return ICMP code */
	char	fr_group[FR_GROUPLEN];	/* group to which this rule belongs */
	char	fr_grhead[FR_GROUPLEN];	/* group # which this rule starts */
	ipftag_t fr_nattag;
	char	fr_ifnames[4][LIFNAMSIZ];
	char	fr_isctag[16];
	frdest_t fr_tifs[2];	/* "to"/"reply-to" interface */
	frdest_t fr_dif;	/* duplicate packet interface */
	/*
	 * This must be last and will change after loaded into the kernel.
	 */
	u_int	fr_cksum;	/* checksum on filter rules for performance */
} frentry_t;

#define	fr_caddr	fr_dun.fru_caddr
#define	fr_data		fr_dun.fru_data
#define	fr_dfunc	fr_dun.fru_func
#define	fr_ipf		fr_dun.fru_ipf
#define	fr_ip		fr_ipf->fri_ip
#define	fr_mip		fr_ipf->fri_mip
#define	fr_icmpm	fr_ipf->fri_icmpm
#define	fr_icmp		fr_ipf->fri_icmp
#define	fr_tuc		fr_ipf->fri_tuc
#define	fr_satype	fr_ipf->fri_satype
#define	fr_datype	fr_ipf->fri_datype
#define	fr_sifpidx	fr_ipf->fri_sifpidx
#define	fr_difpidx	fr_ipf->fri_difpidx
#define	fr_proto	fr_ip.fi_p
#define	fr_mproto	fr_mip.fi_p
#define	fr_ttl		fr_ip.fi_ttl
#define	fr_mttl		fr_mip.fi_ttl
#define	fr_tos		fr_ip.fi_tos
#define	fr_mtos		fr_mip.fi_tos
#define	fr_tcpfm	fr_tuc.ftu_tcpfm
#define	fr_tcpf		fr_tuc.ftu_tcpf
#define	fr_scmp		fr_tuc.ftu_scmp
#define	fr_dcmp		fr_tuc.ftu_dcmp
#define	fr_dport	fr_tuc.ftu_dport
#define	fr_sport	fr_tuc.ftu_sport
#define	fr_stop		fr_tuc.ftu_stop
#define	fr_dtop		fr_tuc.ftu_dtop
#define	fr_dst		fr_ip.fi_dst.in4
#define	fr_daddr	fr_ip.fi_dst.in4.s_addr
#define	fr_src		fr_ip.fi_src.in4
#define	fr_saddr	fr_ip.fi_src.in4.s_addr
#define	fr_dmsk		fr_mip.fi_dst.in4
#define	fr_dmask	fr_mip.fi_dst.in4.s_addr
#define	fr_smsk		fr_mip.fi_src.in4
#define	fr_smask	fr_mip.fi_src.in4.s_addr
#define	fr_dstnum	fr_ip.fi_dstnum
#define	fr_srcnum	fr_ip.fi_srcnum
#define	fr_dlookup	fr_ip.fi_dst
#define	fr_slookup	fr_ip.fi_src
#define	fr_dstname	fr_ip.fi_dstname
#define	fr_srcname	fr_ip.fi_srcname
#define	fr_dsttype	fr_ip.fi_dsttype
#define	fr_srctype	fr_ip.fi_srctype
#define	fr_dstsubtype	fr_ip.fi_dstsubtype
#define	fr_srcsubtype	fr_ip.fi_srcsubtype
#define	fr_dstptr	fr_mip.fi_dstptr
#define	fr_srcptr	fr_mip.fi_srcptr
#define	fr_dstfunc	fr_mip.fi_dstfunc
#define	fr_srcfunc	fr_mip.fi_srcfunc
#define	fr_optbits	fr_ip.fi_optmsk
#define	fr_optmask	fr_mip.fi_optmsk
#define	fr_secbits	fr_ip.fi_secmsk
#define	fr_secmask	fr_mip.fi_secmsk
#define	fr_authbits	fr_ip.fi_auth
#define	fr_authmask	fr_mip.fi_auth
#define	fr_flx		fr_ip.fi_flx
#define	fr_mflx		fr_mip.fi_flx
#define	fr_ifname	fr_ifnames[0]
#define	fr_oifname	fr_ifnames[2]
#define	fr_ifa		fr_ifas[0]
#define	fr_oifa		fr_ifas[2]
#define	fr_tif		fr_tifs[0]
#define	fr_rif		fr_tifs[1]

#define	FR_NOLOGTAG	0

#ifndef	offsetof
#define	offsetof(t,m)	(int)((&((t *)0L)->m))
#endif
#define	FR_CMPSIZ	(sizeof(struct frentry) - \
			 offsetof(struct frentry, fr_func))

/*
 * fr_type
 */
#define	FR_T_NONE	0
#define	FR_T_IPF	1	/* IPF structures */
#define	FR_T_BPFOPC	2	/* BPF opcode */
#define	FR_T_CALLFUNC	3	/* callout to function in fr_func only */
#define	FR_T_COMPIPF	4	/* compiled C code */
#define	FR_T_BUILTIN	0x80000000	/* rule is in kernel space */

/*
 * fr_flags
 */
#define	FR_CALL		0x00000	/* call rule */
#define	FR_BLOCK	0x00001	/* do not allow packet to pass */
#define	FR_PASS		0x00002	/* allow packet to pass */
#define	FR_AUTH		0x00003	/* use authentication */
#define	FR_PREAUTH	0x00004	/* require preauthentication */
#define	FR_ACCOUNT	0x00005	/* Accounting rule */
#define	FR_SKIP		0x00006	/* skip rule */
#define	FR_DIVERT	0x00007	/* divert rule */
#define	FR_CMDMASK	0x0000f
#define	FR_LOG		0x00010	/* Log */
#define	FR_LOGB		0x00011	/* Log-fail */
#define	FR_LOGP		0x00012	/* Log-pass */
#define	FR_LOGMASK	(FR_LOG|FR_CMDMASK)
#define	FR_CALLNOW	0x00020	/* call another function (fr_func) if matches */
#define	FR_NOTSRCIP	0x00040
#define	FR_NOTDSTIP	0x00080
#define	FR_QUICK	0x00100	/* match & stop processing list */
#define	FR_KEEPFRAG	0x00200	/* keep fragment information */
#define	FR_KEEPSTATE	0x00400	/* keep `connection' state information */
#define	FR_FASTROUTE	0x00800	/* bypass normal routing */
#define	FR_RETRST	0x01000	/* Return TCP RST packet - reset connection */
#define	FR_RETICMP	0x02000	/* Return ICMP unreachable packet */
#define	FR_FAKEICMP	0x03000	/* Return ICMP unreachable with fake source */
#define	FR_OUTQUE	0x04000	/* outgoing packets */
#define	FR_INQUE	0x08000	/* ingoing packets */
#define	FR_LOGBODY	0x10000	/* Log the body */
#define	FR_LOGFIRST	0x20000	/* Log the first byte if state held */
#define	FR_LOGORBLOCK	0x40000	/* block the packet if it can't be logged */
#define	FR_DUP		0x80000	/* duplicate packet */
#define	FR_FRSTRICT	0x100000	/* strict frag. cache */
#define	FR_STSTRICT	0x200000	/* strict keep state */
#define	FR_NEWISN	0x400000	/* new ISN for outgoing TCP */
#define	FR_NOICMPERR	0x800000	/* do not match ICMP errors in state */
#define	FR_STATESYNC	0x1000000	/* synchronize state to slave */
#define	FR_NOMATCH	0x8000000	/* no match occured */
		/*	0x10000000 	FF_LOGPASS */
		/*	0x20000000 	FF_LOGBLOCK */
		/*	0x40000000 	FF_LOGNOMATCH */
		/*	0x80000000 	FF_BLOCKNONIP */
#define	FR_COPIED	0x40000000	/* copied from user space */
#define	FR_INACTIVE	0x80000000	/* only used when flush'ing rules */

#define	FR_RETMASK	(FR_RETICMP|FR_RETRST|FR_FAKEICMP)
#define	FR_ISBLOCK(x)	(((x) & FR_CMDMASK) == FR_BLOCK)
#define	FR_ISPASS(x)	(((x) & FR_CMDMASK) == FR_PASS)
#define	FR_ISAUTH(x)	(((x) & FR_CMDMASK) == FR_AUTH)
#define	FR_ISPREAUTH(x)	(((x) & FR_CMDMASK) == FR_PREAUTH)
#define	FR_ISACCOUNT(x)	(((x) & FR_CMDMASK) == FR_ACCOUNT)
#define	FR_ISSKIP(x)	(((x) & FR_CMDMASK) == FR_SKIP)
#define	FR_ISNOMATCH(x)	((x) & FR_NOMATCH)
#define	FR_INOUT	(FR_INQUE|FR_OUTQUE)

/*
 * recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
 */
#define	FF_LOGPASS	0x10000000
#define	FF_LOGBLOCK	0x20000000
#define	FF_LOGNOMATCH	0x40000000
#define	FF_LOGGING	(FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
#define	FF_BLOCKNONIP	0x80000000	/* Solaris2 Only */

/*
 * Structure that passes information on what/how to flush to the kernel.
 */
typedef	struct	ipfflush	{
	int	ipflu_how;
	int	ipflu_arg;
} ipfflush_t;

/*
 *
 */
typedef	struct	ipfgetctl	{
	u_int	ipfg_min;	/* min value */
	u_int	ipfg_current;	/* current value */
	u_int	ipfg_max;	/* max value */
	u_int	ipfg_default;	/* default value */
	u_int	ipfg_steps;	/* value increments */
	char	ipfg_name[40];	/* tag name for this control */
} ipfgetctl_t;

typedef	struct	ipfsetctl	{
	int	ipfs_which;	/* 0 = min 1 = current 2 = max 3 = default */
	u_int	ipfs_value;	/* min value */
	char	ipfs_name[40];	/* tag name for this control */
} ipfsetctl_t;

/*
 * Some of the statistics below are in their own counters, but most are kept
 * in this single structure so that they can all easily be collected and
 * copied back as required.
 */
typedef	struct	filterstats {
	u_long	fr_pass;	/* packets allowed */
	u_long	fr_block;	/* packets denied */
	u_long	fr_nom;		/* packets which don't match any rule */
	u_long	fr_short;	/* packets which are short */
	u_long	fr_ppkl;	/* packets allowed and logged */
	u_long	fr_bpkl;	/* packets denied and logged */
	u_long	fr_npkl;	/* packets unmatched and logged */
	u_long	fr_pkl;		/* packets logged */
	u_long	fr_skip;	/* packets to be logged but buffer full */
	u_long	fr_ret;		/* packets for which a return is sent */
	u_long	fr_acct;	/* packets for which counting was performed */
	u_long	fr_bnfr;	/* bad attempts to allocate fragment state */
	u_long	fr_nfr;		/* new fragment state kept */
	u_long	fr_cfr;		/* add new fragment state but complete pkt */
	u_long	fr_bads;	/* bad attempts to allocate packet state */
	u_long	fr_ads;		/* new packet state kept */
	u_long	fr_chit;	/* cached hit */
	u_long	fr_tcpbad;	/* TCP checksum check failures */
	u_long	fr_pull[2];	/* good and bad pullup attempts */
	u_long	fr_badsrc;	/* source received doesn't match route */
	u_long	fr_badttl;	/* TTL in packet doesn't reach minimum */
	u_long	fr_bad;		/* bad IP packets to the filter */
	u_long	fr_ipv6;	/* IPv6 packets in/out */
	u_long	fr_ppshit;	/* dropped because of pps ceiling */
	u_long	fr_ipud;	/* IP id update failures */
} filterstats_t;

/*
 * Log structure.  Each packet header logged is prepended by one of these.
 * Following this in the log records read from the device will be an ipflog
 * structure which is then followed by any packet data.
 */
typedef	struct	iplog	{
	u_32_t		ipl_magic;
	u_int		ipl_count;
	struct	timeval	ipl_time;
	size_t		ipl_dsize;
	struct	iplog	*ipl_next;
} iplog_t;

#define	ipl_sec		ipl_time.tv_sec
#define	ipl_usec	ipl_time.tv_usec

#define IPL_MAGIC	0x49504c4d	/* 'IPLM' */
#define IPL_MAGIC_NAT	0x49504c4e	/* 'IPLN' */
#define IPL_MAGIC_STATE	0x49504c53	/* 'IPLS' */
#define	IPLOG_SIZE	sizeof(iplog_t)

typedef	struct	ipflog	{
#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
        (defined(OpenBSD) && (OpenBSD >= 199603))
#else
	u_int	fl_unit;
#endif
	u_32_t	fl_rule;
	u_32_t	fl_flags;
	u_32_t	fl_lflags;
	u_32_t	fl_logtag;
	ipftag_t	fl_nattag;
	u_short	fl_plen;	/* extra data after hlen */
	u_short	fl_loglevel;	/* syslog log level */
	char	fl_group[FR_GROUPLEN];
	u_char	fl_hlen;	/* length of IP headers saved */
	u_char	fl_dir;
	u_char	fl_xxx[2];	/* pad */
	char	fl_ifname[LIFNAMSIZ];
} ipflog_t;

#ifndef	IPF_LOGGING
# define	IPF_LOGGING	0
#endif
#ifndef	IPF_DEFAULT_PASS
# define	IPF_DEFAULT_PASS	FR_PASS
#endif

#define	DEFAULT_IPFLOGSIZE	8192
#ifndef	IPFILTER_LOGSIZE
# define	IPFILTER_LOGSIZE	DEFAULT_IPFLOGSIZE
#else
# if IPFILTER_LOGSIZE < DEFAULT_IPFLOGSIZE
#  error IPFILTER_LOGSIZE too small.  Must be >= DEFAULT_IPFLOGSIZE
# endif
#endif

#define	IPF_OPTCOPY	0x07ff00	/* bit mask of copied options */

/*
 * Device filenames for reading log information.  Use ipf on Solaris2 because
 * ipl is already a name used by something else.
 */
#ifndef	IPL_NAME
# if	SOLARIS
#  define	IPL_NAME	"/dev/ipf"
# else
#  define	IPL_NAME	"/dev/ipl"
# endif
#endif
/*
 * Pathnames for various IP Filter control devices.  Used by LKM
 * and userland, so defined here.
 */
#define	IPNAT_NAME	"/dev/ipnat"
#define	IPSTATE_NAME	"/dev/ipstate"
#define	IPAUTH_NAME	"/dev/ipauth"
#define	IPSYNC_NAME	"/dev/ipsync"
#define	IPSCAN_NAME	"/dev/ipscan"
#define	IPLOOKUP_NAME	"/dev/iplookup"

#define	IPL_LOGIPF	0	/* Minor device #'s for accessing logs */
#define	IPL_LOGNAT	1
#define	IPL_LOGSTATE	2
#define	IPL_LOGAUTH	3
#define	IPL_LOGSYNC	4
#define	IPL_LOGSCAN	5
#define	IPL_LOGLOOKUP	6
#define	IPL_LOGCOUNT	7
#define	IPL_LOGMAX	7
#define	IPL_LOGSIZE	IPL_LOGMAX + 1
#define	IPL_LOGALL	-1
#define	IPL_LOGNONE	-2

/*
 * For SIOCGETFS
 */
typedef	struct	friostat	{
	struct	filterstats	f_st[2];
	struct	frentry		*f_ipf[2][2];
	struct	frentry		*f_acct[2][2];
	struct	frentry		*f_ipf6[2][2];
	struct	frentry		*f_acct6[2][2];
	struct	frentry		*f_auth;
	struct	frgroup		*f_groups[IPL_LOGSIZE][2];
	u_long	f_froute[2];
	u_long	f_ticks;
	int	f_locks[IPL_LOGMAX];
	size_t	f_kmutex_sz;
	size_t	f_krwlock_sz;
	int	f_defpass;	/* default pass - from fr_pass */
	int	f_active;	/* 1 or 0 - active rule set */
	int	f_running;	/* 1 if running, else 0 */
	int	f_logging;	/* 1 if enabled, else 0 */
	int	f_features;
	char	f_version[32];	/* version string */
} friostat_t;

#define	f_fin		f_ipf[0]
#define	f_fin6		f_ipf6[0]
#define	f_fout		f_ipf[1]
#define	f_fout6		f_ipf6[1]
#define	f_acctin	f_acct[0]
#define	f_acctin6	f_acct6[0]
#define	f_acctout	f_acct[1]
#define	f_acctout6	f_acct6[1]

#define	IPF_FEAT_LKM		0x001
#define	IPF_FEAT_LOG		0x002
#define	IPF_FEAT_LOOKUP		0x004
#define	IPF_FEAT_BPF		0x008
#define	IPF_FEAT_COMPILED	0x010
#define	IPF_FEAT_CKSUM		0x020
#define	IPF_FEAT_SYNC		0x040
#define	IPF_FEAT_SCAN		0x080
#define	IPF_FEAT_IPV6		0x100

typedef struct	optlist {
	u_short ol_val;
	int	ol_bit;
} optlist_t;

/*
 * Group list structure.
 */
typedef	struct frgroup {
	struct	frgroup	*fg_next;
	struct	frentry	*fg_head;
	struct	frentry	*fg_start;
	u_32_t	fg_flags;
	int	fg_ref;
	char	fg_name[FR_GROUPLEN];
} frgroup_t;

#define	FG_NAME(g)	(*(g)->fg_name == '\0' ? "" : (g)->fg_name)

/*
 * Used by state and NAT tables
 */
typedef struct icmpinfo {
	u_short	ici_id;
	u_short	ici_seq;
	u_char	ici_type;
} icmpinfo_t;

typedef struct udpinfo {
	u_short	us_sport;
	u_short	us_dport;
} udpinfo_t;

typedef	struct	tcpdata	{
	u_32_t	td_end;
	u_32_t	td_maxend;
	u_32_t	td_maxwin;
	u_32_t	td_winscale;
	u_32_t	td_maxseg;
	int	td_winflags;
} tcpdata_t;

#define	TCP_WSCALE_MAX		14

#define	TCP_WSCALE_SEEN		0x00000001
#define	TCP_WSCALE_FIRST	0x00000002
#define	TCP_SACK_PERMIT		0x00000004

typedef	struct tcpinfo {
	u_short	ts_sport;
	u_short	ts_dport;
	tcpdata_t ts_data[2];
} tcpinfo_t;

/*
 * Structures to define a GRE header as seen in a packet.
 */
struct	grebits	{
	u_32_t	grb_C:1;
	u_32_t	grb_R:1;
	u_32_t	grb_K:1;
	u_32_t	grb_S:1;
	u_32_t	grb_s:1;
	u_32_t	grb_recur:1;
	u_32_t	grb_A:1;
	u_32_t	grb_flags:3;
	u_32_t	grb_ver:3;
	u_short	grb_ptype;
};

typedef	struct	grehdr	{
	union	{
		struct	grebits	gru_bits;
		u_short	gru_flags;
	} gr_un;
	u_short	gr_len;
	u_short	gr_call;
} grehdr_t;

#define	gr_flags	gr_un.gru_flags
#define	gr_bits		gr_un.gru_bits
#define	gr_ptype	gr_bits.grb_ptype
#define	gr_C		gr_bits.grb_C
#define	gr_R		gr_bits.grb_R
#define	gr_K		gr_bits.grb_K
#define	gr_S		gr_bits.grb_S
#define	gr_s		gr_bits.grb_s
#define	gr_recur	gr_bits.grb_recur
#define	gr_A		gr_bits.grb_A
#define	gr_ver		gr_bits.grb_ver

/*
 * GRE information tracked by "keep state"
 */
typedef	struct	greinfo	{
	u_short	gs_call[2];
	u_short	gs_flags;
	u_short	gs_ptype;
} greinfo_t;

#define	GRE_REV(x)	((ntohs(x) >> 13) & 7)

/*
 * Format of an Authentication header
 */
typedef	struct	authhdr	{
	u_char	ah_next;
	u_char	ah_plen;
	u_short	ah_reserved;
	u_32_t	ah_spi;
	u_32_t	ah_seq;
	/* Following the sequence number field is 0 or more bytes of */
	/* authentication data, as specified by ah_plen - RFC 2402.  */
} authhdr_t;

/*
 * Timeout tail queue list member
 */
typedef	struct	ipftqent	{
	struct ipftqent **tqe_pnext;
	struct ipftqent *tqe_next;
	struct	ipftq	*tqe_ifq;
	void	*tqe_parent;		/* pointer back to NAT/state struct */
	u_long	tqe_die;		/* when this entriy is to die */
	u_long	tqe_touched;
	int	tqe_flags;
	int	tqe_state[2];		/* current state of this entry */
} ipftqent_t;

#define	TQE_RULEBASED	0x00000001

/*
 * Timeout tail queue head for IPFilter
 */
typedef struct  ipftq   {
	ipfmutex_t	ifq_lock;
	u_int	ifq_ttl;
	ipftqent_t	*ifq_head;
	ipftqent_t	**ifq_tail;
	struct	ipftq	*ifq_next;
	struct	ipftq	**ifq_pnext;
	int	ifq_ref;
	u_int	ifq_flags;
} ipftq_t;

#define	IFQF_USER	0x01		/* User defined aging */
#define	IFQF_DELETE	0x02		/* Marked for deletion */
#define	IFQF_PROXY	0x04		/* Timeout queue in use by a proxy */

#define	IPF_HZ_MULT	1
#define	IPF_HZ_DIVIDE	2		/* How many times a second ipfilter */
					/* checks its timeout queues.       */
#define	IPF_TTLVAL(x)	(((x) / IPF_HZ_MULT) * IPF_HZ_DIVIDE)

typedef	int	(*ipftq_delete_fn_t)(void *);

/*
 * Structure to define address for pool lookups.
 */
typedef	struct	{
	u_char		adf_len;
	i6addr_t	adf_addr;
} addrfamily_t;

/*
 * Object structure description.  For passing through in ioctls.
 */
typedef	struct	ipfobj	{
	u_32_t	ipfo_rev;		/* IPFilter version number */
	u_32_t	ipfo_size;		/* size of object at ipfo_ptr */
	void	*ipfo_ptr;		/* pointer to object */
	int	ipfo_type;		/* type of object being pointed to */
	int	ipfo_offset;		/* bytes from ipfo_ptr where to start */
	u_char	ipfo_xxxpad[32];	/* reserved for future use */
} ipfobj_t;

#define	IPFOBJ_FRENTRY		0	/* struct frentry */
#define	IPFOBJ_IPFSTAT		1	/* struct friostat */
#define	IPFOBJ_IPFINFO		2	/* struct fr_info */
#define	IPFOBJ_AUTHSTAT		3	/* struct fr_authstat */
#define	IPFOBJ_FRAGSTAT		4	/* struct ipfrstat */
#define	IPFOBJ_IPNAT		5	/* struct ipnat */
#define	IPFOBJ_NATSTAT		6	/* struct natstat */
#define	IPFOBJ_STATESAVE	7	/* struct ipstate_save */
#define	IPFOBJ_NATSAVE		8	/* struct nat_save */
#define	IPFOBJ_NATLOOKUP	9	/* struct natlookup */
#define	IPFOBJ_IPSTATE		10	/* struct ipstate */
#define	IPFOBJ_STATESTAT	11	/* struct ips_stat */
#define	IPFOBJ_FRAUTH		12	/* struct frauth */
#define	IPFOBJ_TUNEABLE		13	/* struct ipftune */
#define	IPFOBJ_NAT		14	/* struct nat */
#define	IPFOBJ_IPFITER		15	/* struct ipfruleiter */
#define	IPFOBJ_GENITER		16	/* struct ipfgeniter */
#define	IPFOBJ_GTABLE		17	/* struct ipftable */
#define	IPFOBJ_LOOKUPITER	18	/* struct ipflookupiter */
#define	IPFOBJ_STATETQTAB	19	/* struct ipftq [NSTATES] */
#define	IPFOBJ_COUNT		20	/* How many #defines are above this? */

typedef	union	ipftunevalptr	{
	void	*ipftp_void;
	u_long	*ipftp_long;
	u_int	*ipftp_int;
	u_short	*ipftp_short;
	u_char	*ipftp_char;
} ipftunevalptr_t;

typedef	struct	ipftuneable	{
	ipftunevalptr_t	ipft_una;
	const char	*ipft_name;
	u_long		ipft_min;
	u_long		ipft_max;
	int		ipft_sz;
	int		ipft_flags;
	struct ipftuneable *ipft_next;
} ipftuneable_t;

#define	ipft_addr	ipft_una.ipftp_void
#define	ipft_plong	ipft_una.ipftp_long
#define	ipft_pint	ipft_una.ipftp_int
#define	ipft_pshort	ipft_una.ipftp_short
#define	ipft_pchar	ipft_una.ipftp_char

#define	IPFT_RDONLY	1	/* read-only */
#define	IPFT_WRDISABLED	2	/* write when disabled only */

typedef	union	ipftuneval	{
	u_long	ipftu_long;
	u_int	ipftu_int;
	u_short	ipftu_short;
	u_char	ipftu_char;
} ipftuneval_t;

typedef	struct	ipftune	{
	void    	*ipft_cookie;
	ipftuneval_t	ipft_un;
	u_long  	ipft_min;
	u_long  	ipft_max;
	int		ipft_sz;
	int		ipft_flags;
	char		ipft_name[80];
} ipftune_t;

#define	ipft_vlong	ipft_un.ipftu_long
#define	ipft_vint	ipft_un.ipftu_int
#define	ipft_vshort	ipft_un.ipftu_short
#define	ipft_vchar	ipft_un.ipftu_char

/*
 *
 */
typedef	struct	ipfruleiter {
	int		iri_inout;
	char		iri_group[FR_GROUPLEN];
	int		iri_active;
	int		iri_nrules;
	int		iri_v;
	frentry_t	*iri_rule;
} ipfruleiter_t;

/*
 * Values for iri_inout
 */
#define	F_IN	0
#define	F_OUT	1
#define	F_ACIN	2
#define	F_ACOUT	3

typedef	struct	ipfgeniter {
	int	igi_type;
	int	igi_nitems;
	void	*igi_data;
} ipfgeniter_t;

#define	IPFGENITER_IPF		0
#define	IPFGENITER_NAT		1
#define	IPFGENITER_IPNAT	2
#define	IPFGENITER_FRAG		3
#define	IPFGENITER_AUTH		4
#define	IPFGENITER_STATE	5
#define	IPFGENITER_NATFRAG	6
#define	IPFGENITER_HOSTMAP	7
#define	IPFGENITER_LOOKUP	8

typedef	struct	ipftable {
	int	ita_type;
	void	*ita_table;
} ipftable_t;

#define	IPFTABLE_BUCKETS	1
#define	IPFTABLE_BUCKETS_NATIN	2
#define	IPFTABLE_BUCKETS_NATOUT	3

/*
 *
 */
typedef struct ipftoken {
	struct ipftoken	*ipt_next;
	struct ipftoken	**ipt_pnext;
	void		*ipt_ctx;
	void		*ipt_data;
	u_long		ipt_die;
	int		ipt_type;
	int		ipt_uid;
	int		ipt_subtype;
	int		ipt_alive;
} ipftoken_t;

/*
** HPUX Port
*/
#ifdef __hpux
/* HP-UX locking sequence deadlock detection module lock MAJOR ID */
# define	IPF_SMAJ	0	/* temp assignment XXX, not critical */
#endif

#if !defined(CDEV_MAJOR) && defined (__FreeBSD_version) && \
    (__FreeBSD_version >= 220000)
# define	CDEV_MAJOR	79
#endif

/*
 * Post NetBSD 1.2 has the PFIL interface for packet filters.  This turns
 * on those hooks.  We don't need any special mods in non-IP Filter code
 * with this!
 */
#if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
    (defined(NetBSD1_2) && NetBSD1_2 > 1) || \
    (defined(__FreeBSD__) && (__FreeBSD_version >= 500043))
# if defined(NetBSD) && (NetBSD >= 199905)
#  define PFIL_HOOKS
# endif
# ifdef PFIL_HOOKS
#  define NETBSD_PF
# endif
#endif

#ifdef _KERNEL
# define	FR_VERBOSE(verb_pr)
# define	FR_DEBUG(verb_pr)
#else
extern	void	debug __P((char *, ...));
extern	void	verbose __P((char *, ...));
# define	FR_VERBOSE(verb_pr)	verbose verb_pr
# define	FR_DEBUG(verb_pr)	debug verb_pr
#endif

#ifndef	_KERNEL
extern	int	fr_check __P((struct ip *, int, void *, int, mb_t **));
extern	int	(*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
extern	int	ipf_log __P((void));
extern	struct	ifnet *get_unit __P((char *, int));
extern	char	*get_ifname __P((struct ifnet *));
# if defined(__NetBSD__) || defined(__OpenBSD__) || \
	  (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
extern	int	iplioctl __P((int, ioctlcmd_t, caddr_t, int));
# else
extern	int	iplioctl __P((int, ioctlcmd_t, caddr_t, int));
# endif
extern	int	iplopen __P((dev_t, int));
extern	int	iplclose __P((dev_t, int));
extern	void	m_freem __P((mb_t *));
extern	int	bcopywrap __P((void *, void *, size_t));
#else /* #ifndef _KERNEL */
# ifdef BSD
#  if (defined(__NetBSD__) && (__NetBSD_Version__ < 399000000)) || \
      defined(__osf__) || \
      (defined(__FreeBSD_version) && (__FreeBSD_version < 500043))
#   include <sys/select.h>
#  else
#   include <sys/selinfo.h>
#  endif
extern struct selinfo ipfselwait[IPL_LOGSIZE];
# endif
# if defined(__NetBSD__) && defined(PFIL_HOOKS)
extern	void	ipfilterattach __P((int));
# endif
extern	int	ipl_enable __P((void));
extern	int	ipl_disable __P((void));
extern	int	ipf_inject __P((fr_info_t *, mb_t *));
# ifdef MENTAT
extern	int	fr_check __P((struct ip *, int, void *, int, void *,
			      mblk_t **));
#  if SOLARIS
#   if SOLARIS2 >= 7
extern	int	iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
#   else
extern	int	iplioctl __P((dev_t, int, int *, int, cred_t *, int *));
#   endif
extern	int	iplopen __P((dev_t *, int, int, cred_t *));
extern	int	iplclose __P((dev_t, int, int, cred_t *));
extern	int	iplread __P((dev_t, uio_t *, cred_t *));
extern	int	iplwrite __P((dev_t, uio_t *, cred_t *));
#  endif
#  ifdef __hpux
extern	int	iplopen __P((dev_t, int, intptr_t, int));
extern	int	iplclose __P((dev_t, int, int));
extern	int	iplioctl __P((dev_t, int, caddr_t, int));
extern	int	iplread __P((dev_t, uio_t *));
extern	int	iplwrite __P((dev_t, uio_t *));
extern	int	iplselect __P((dev_t, int));
#  endif
extern	int	fr_qout __P((queue_t *, mblk_t *));
# else /* MENTAT */
extern	int	fr_check __P((struct ip *, int, void *, int, mb_t **));
extern	int	(*fr_checkp) __P((ip_t *, int, void *, int, mb_t **));
extern	size_t	mbufchainlen __P((mb_t *));
#  ifdef	__sgi
#   include <sys/cred.h>
extern	int	iplioctl __P((dev_t, int, caddr_t, int, cred_t *, int *));
extern	int	iplopen __P((dev_t *, int, int, cred_t *));
extern	int	iplclose __P((dev_t, int, int, cred_t *));
extern	int	iplread __P((dev_t, uio_t *, cred_t *));
extern	int	iplwrite __P((dev_t, uio_t *, cred_t *));
extern	int	ipfilter_sgi_attach __P((void));
extern	void	ipfilter_sgi_detach __P((void));
extern	void	ipfilter_sgi_intfsync __P((void));
#  else
#   ifdef	IPFILTER_LKM
extern	int	iplidentify __P((char *));
#   endif
#   if (defined(_BSDI_VERSION) && _BSDI_VERSION >= 199510) || \
      (__FreeBSD_version >= 220000) || \
      (NetBSD >= 199511) || defined(__OpenBSD__)
#    if defined(__NetBSD__) || \
       (defined(_BSDI_VERSION) && _BSDI_VERSION >= 199701) || \
       defined(__OpenBSD__) || (__FreeBSD_version >= 300000)
#     if (__FreeBSD_version >= 500024)
#      if (__FreeBSD_version >= 502116)
extern	int	iplioctl __P((struct cdev*, u_long, caddr_t, int, struct thread *));
#      else
extern	int	iplioctl __P((dev_t, u_long, caddr_t, int, struct thread *));
#      endif /* __FreeBSD_version >= 502116 */
#     else
#      if  (__NetBSD_Version__ >= 499001000)
extern	int	iplioctl __P((dev_t, u_long, void *, int, struct lwp *));
#       else
#       if  (__NetBSD_Version__ >= 399001400)
extern	int	iplioctl __P((dev_t, u_long, caddr_t, int, struct lwp *));
#       else
extern	int	iplioctl __P((dev_t, u_long, caddr_t, int, struct proc *));
#       endif
#      endif
#     endif /* __FreeBSD_version >= 500024 */
#    else
extern	int	iplioctl __P((dev_t, int, caddr_t, int, struct thread *));
#    endif
#    if (__FreeBSD_version >= 500024)
#      if (__FreeBSD_version >= 502116)
extern	int	iplopen __P((struct cdev*, int, int, struct thread *));
extern	int	iplclose __P((struct cdev*, int, int, struct thread *));
#      else
extern	int	iplopen __P((dev_t, int, int, struct thread *));
extern	int	iplclose __P((dev_t, int, int, struct thread *));
#      endif /* __FreeBSD_version >= 502116 */
#    else
#     if  (__NetBSD_Version__ >= 399001400)
extern	int	iplopen __P((dev_t, int, int, struct lwp *));
extern	int	iplclose __P((dev_t, int, int, struct lwp *));
#     else
extern	int	iplopen __P((dev_t, int, int, struct proc *));
extern	int	iplclose __P((dev_t, int, int, struct proc *));
#     endif /* __NetBSD_Version__ >= 399001400 */
#    endif /* __FreeBSD_version >= 500024 */
#   else
#    ifdef linux
extern	int	iplioctl __P((struct inode *, struct file *, u_int, u_long));
#    else
extern	int	iplopen __P((dev_t, int));
extern	int	iplclose __P((dev_t, int));
extern	int	iplioctl __P((dev_t, int, caddr_t, int));
#    endif
#   endif /* (_BSDI_VERSION >= 199510) */
#   if	BSD >= 199306
#      if (__FreeBSD_version >= 502116)
extern	int	iplread __P((struct cdev*, struct uio *, int));
extern	int	iplwrite __P((struct cdev*, struct uio *, int));
#      else
extern	int	iplread __P((dev_t, struct uio *, int));
extern	int	iplwrite __P((dev_t, struct uio *, int));
#      endif /* __FreeBSD_version >= 502116 */
#   else
#    ifndef linux
extern	int	iplread __P((dev_t, struct uio *));
extern	int	iplwrite __P((dev_t, struct uio *));
#    endif
#   endif /* BSD >= 199306 */
#  endif /* __ sgi */
# endif /* MENTAT */

# if defined(__FreeBSD_version)
extern	int	ipf_pfil_hook __P((void));
extern	int	ipf_pfil_unhook __P((void));
extern	void	ipf_event_reg __P((void));
extern	void	ipf_event_dereg __P((void));
# endif

#endif /* #ifndef _KERNEL */

extern	ipfmutex_t	ipl_mutex, ipf_authmx, ipf_rw, ipf_hostmap;
extern	ipfmutex_t	ipf_timeoutlock, ipf_stinsert, ipf_natio, ipf_nat_new;
extern	ipfrwlock_t	ipf_mutex, ipf_global, ip_poolrw, ipf_ipidfrag;
extern	ipfrwlock_t	ipf_frag, ipf_state, ipf_nat, ipf_natfrag, ipf_auth;
extern	ipfrwlock_t	ipf_frcache, ipf_tokens;

extern	char	*memstr __P((const char *, char *, size_t, size_t));
extern	int	count4bits __P((u_32_t));
extern	int	frrequest __P((int, ioctlcmd_t, caddr_t, int, int));
extern	char	*getifname __P((struct ifnet *));
extern	int	ipfattach __P((void));
extern	int	ipfdetach __P((void));
extern	u_short	ipf_cksum __P((u_short *, int));
extern	int	copyinptr __P((void *, void *, size_t));
extern	int	copyoutptr __P((void *, void *, size_t));
extern	int	fr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *));
extern	int	fr_inobj __P((void *, void *, int));
extern	int	fr_inobjsz __P((void *, void *, int, int));
extern	int	fr_ioctlswitch __P((int, void *, ioctlcmd_t, int, int, void *));
extern	int	fr_ipf_ioctl __P((caddr_t, ioctlcmd_t, int, int, void *));
extern	int	fr_ipftune __P((ioctlcmd_t, void *));
extern	int	fr_outobj __P((void *, void *, int));
extern	int	fr_outobjsz __P((void *, void *, int, int));
extern	void	*fr_pullup __P((mb_t *, fr_info_t *, int));
extern	void	fr_resolvedest __P((struct frdest *, int));
extern	int	fr_resolvefunc __P((void *));
extern	void	*fr_resolvenic __P((char *, int));
extern	int	fr_send_icmp_err __P((int, fr_info_t *, int));
extern	int	fr_send_reset __P((fr_info_t *));
#if  (__FreeBSD_version < 501000) || !defined(_KERNEL)
extern	int	ppsratecheck __P((struct timeval *, int *, int));
#endif
extern	ipftq_t	*fr_addtimeoutqueue __P((ipftq_t **, u_int));
extern	void	fr_deletequeueentry __P((ipftqent_t *));
extern	int	fr_deletetimeoutqueue __P((ipftq_t *));
extern	void	fr_freetimeoutqueue __P((ipftq_t *));
extern	void	fr_movequeue __P((ipftqent_t *, ipftq_t *, ipftq_t *));
extern	void	fr_queueappend __P((ipftqent_t *, ipftq_t *, void *));
extern	void	fr_queueback __P((ipftqent_t *));
extern	void	fr_queuefront __P((ipftqent_t *));
extern	void	fr_checkv4sum __P((fr_info_t *));
extern	int	fr_checkl4sum __P((fr_info_t *));
extern	int	fr_ifpfillv4addr __P((int, struct sockaddr_in *,
				      struct sockaddr_in *, struct in_addr *,
				      struct in_addr *));
extern	int	fr_coalesce __P((fr_info_t *));
#ifdef	USE_INET6
extern	void	fr_checkv6sum __P((fr_info_t *));
extern	int	fr_ifpfillv6addr __P((int, struct sockaddr_in6 *,
				      struct sockaddr_in6 *, struct in_addr *,
				      struct in_addr *));
#endif

extern	int		fr_addipftune __P((ipftuneable_t *));
extern	int		fr_delipftune __P((ipftuneable_t *));

extern	int	frflush __P((minor_t, int, int));
extern	void	frsync __P((void *));
extern	frgroup_t *fr_addgroup __P((char *, void *, u_32_t, minor_t, int));
extern	int	fr_derefrule __P((frentry_t **));
extern	void	fr_delgroup __P((char *, minor_t, int));
extern	frgroup_t *fr_findgroup __P((char *, minor_t, int, frgroup_t ***));

extern	int	fr_loginit __P((void));
extern	int	ipflog_canread __P((int));
extern	int	ipflog_clear __P((minor_t));
extern	int	ipflog_read __P((minor_t, uio_t *));
extern	int	ipflog __P((fr_info_t *, u_int));
extern	int	ipllog __P((int, fr_info_t *, void **, size_t *, int *, int));
extern	void	fr_logunload __P((void));

extern	frentry_t	*fr_acctpkt __P((fr_info_t *, u_32_t *));
extern	int		fr_copytolog __P((int, char *, int));
extern	u_short		fr_cksum __P((mb_t *, ip_t *, int, void *, int));
extern	void		fr_deinitialise __P((void));
extern	frentry_t 	*fr_dolog __P((fr_info_t *, u_32_t *));
extern	frentry_t 	*fr_dstgrpmap __P((fr_info_t *, u_32_t *));
extern	void		fr_fixskip __P((frentry_t **, frentry_t *, int));
extern	void		fr_forgetifp __P((void *));
extern	frentry_t 	*fr_getrulen __P((int, char *, u_32_t));
extern	void		fr_getstat __P((struct friostat *));
extern	int		fr_ifpaddr __P((int, int, void *,
				struct in_addr *, struct in_addr *));
extern	int		fr_initialise __P((void));
extern	int		fr_lock __P((caddr_t, int *));
extern  int		fr_makefrip __P((int, ip_t *, fr_info_t *));
extern	int		fr_matchtag __P((ipftag_t *, ipftag_t *));
extern	int		fr_matchicmpqueryreply __P((int, icmpinfo_t *,
					    struct icmp *, int));
extern	u_32_t		fr_newisn __P((fr_info_t *));
extern	u_short		fr_nextipid __P((fr_info_t *));
extern	int	ipf_queueflush __P((ipftq_delete_fn_t, ipftq_t *, ipftq_t *));
extern	int		fr_rulen __P((int, frentry_t *));
extern	int		fr_scanlist __P((fr_info_t *, u_32_t));
extern	frentry_t 	*fr_srcgrpmap __P((fr_info_t *, u_32_t *));
extern	int		fr_tcpudpchk __P((fr_info_t *, frtuc_t *));
extern	int		fr_verifysrc __P((fr_info_t *fin));
extern	int		fr_zerostats __P((void *));
extern	ipftoken_t	*ipf_findtoken __P((int, int, void *));
extern	int		ipf_getnextrule __P((ipftoken_t *, void *));
extern	void		ipf_expiretokens __P((void));
extern	void		ipf_freetoken __P((ipftoken_t *));
extern	int		ipf_deltoken __P((int,int, void *));
extern	int		ipfsync __P((void));
extern	int		ipf_genericiter __P((void *, int, void *));
#ifndef ipf_random
extern	u_32_t		ipf_random __P((void));
#endif
#ifdef NEED_LOCAL_RAND
extern	void		ipf_rand_push __P((void *, int));
#endif

extern	int	fr_running;
extern	u_long	fr_frouteok[2];
extern	int	fr_pass;
extern	int	fr_flags;
extern	int	fr_active;
extern	int	fr_chksrc;
extern	int	fr_minttl;
extern	int	fr_refcnt;
extern	int	fr_control_forwarding;
extern	int	fr_update_ipid;
extern	int	nat_logging;
extern	int	ipstate_logging;
extern	int	ipl_suppress;
extern	int	ipl_logmax;
extern	int	ipl_logall;
extern	int	ipl_logsize;
extern	u_long	fr_ticks;
extern	fr_info_t	frcache[2][8];
extern	char	ipfilter_version[];
extern	iplog_t	**iplh[IPL_LOGMAX+1], *iplt[IPL_LOGMAX+1];
extern	int	iplused[IPL_LOGMAX + 1];
extern	struct frentry *ipfilter[2][2], *ipacct[2][2];
#ifdef	USE_INET6
extern	struct frentry *ipfilter6[2][2], *ipacct6[2][2];
extern	int	icmptoicmp6types[ICMP_MAXTYPE+1];
extern	int	icmptoicmp6unreach[ICMP_MAX_UNREACH];
extern	int	icmpreplytype6[ICMP6_MAXTYPE + 1];
#endif
extern	int	icmpreplytype4[ICMP_MAXTYPE + 1];
extern	struct frgroup *ipfgroups[IPL_LOGSIZE][2];
extern	struct filterstats frstats[];
extern	frentry_t *ipfrule_match __P((fr_info_t *));
extern	u_char	ipf_iss_secret[32];
extern	ipftuneable_t ipf_tuneables[];

#endif	/* __IP_FIL_H__ */


code:
/*	$FreeBSD: release/9.0.0/sys/contrib/ipfilter/netinet/ip_frag.h 170268 2007-06-04 02:54:36Z darrenr $	*/

/*
 * Copyright (C) 1993-2001 by Darren Reed.
 *
 * See the IPFILTER.LICENCE file for details on licencing.
 *
 * @(#)ip_frag.h	1.5 3/24/96
 * $FreeBSD: release/9.0.0/sys/contrib/ipfilter/netinet/ip_frag.h 170268 2007-06-04 02:54:36Z darrenr $
 * Id: ip_frag.h,v 2.23.2.1 2004/03/29 16:21:56 darrenr Exp
 */

#ifndef	__IP_FRAG_H__
#define	__IP_FRAG_H__

#define	IPFT_SIZE	257

typedef	struct	ipfr	{
	struct	ipfr	*ipfr_hnext, **ipfr_hprev;
	struct	ipfr	*ipfr_next, **ipfr_prev;
	void	*ipfr_data;
	frentry_t *ipfr_rule;
	u_long	ipfr_ttl;
	int	ipfr_ref;
	u_short	ipfr_off;
	u_short	ipfr_seen0;
	/*
	 * All of the fields, from ipfr_ifp to ipfr_pass, are compared
	 * using bcmp to see if an identical entry is present.  It is
	 * therefore important for this set to remain together.
	 */
	void	*ipfr_ifp;
	struct	in_addr	ipfr_src;
	struct	in_addr	ipfr_dst;
	u_32_t	ipfr_optmsk;
	u_short	ipfr_secmsk;
	u_short	ipfr_auth;
	u_short	ipfr_id;
	u_char	ipfr_p;
	u_char	ipfr_tos;
	u_32_t	ipfr_pass;
} ipfr_t;

typedef	struct	ipfrstat {
	u_long	ifs_exists;	/* add & already exists */
	u_long	ifs_nomem;
	u_long	ifs_new;
	u_long	ifs_hits;
	u_long	ifs_expire;
	u_long	ifs_inuse;
	u_long	ifs_retrans0;
	u_long	ifs_short;
	struct	ipfr	**ifs_table;
	struct	ipfr	**ifs_nattab;
} ipfrstat_t;

#define	IPFR_CMPSZ	(offsetof(ipfr_t, ipfr_pass) - \
			 offsetof(ipfr_t, ipfr_ifp))

extern	ipfr_t	*ipfr_list, **ipfr_tail;
extern	ipfr_t	*ipfr_natlist, **ipfr_nattail;
extern	int	ipfr_size;
extern	int	fr_ipfrttl;
extern	int	fr_frag_lock;
extern	int	fr_fraginit __P((void));
extern	void	fr_fragunload __P((void));
extern	ipfrstat_t	*fr_fragstats __P((void));

extern	int	fr_newfrag __P((fr_info_t *, u_32_t));
extern	frentry_t *fr_knownfrag __P((fr_info_t *, u_32_t *));

extern	int	fr_nat_newfrag __P((fr_info_t *, u_32_t, struct nat *));
extern	nat_t	*fr_nat_knownfrag __P((fr_info_t *));

extern	int	fr_ipid_newfrag __P((fr_info_t *, u_32_t));
extern	u_32_t	fr_ipid_knownfrag __P((fr_info_t *));
#ifdef USE_MUTEXES
extern	void	fr_fragderef __P((ipfr_t **, ipfrwlock_t *));
extern	int	fr_nextfrag __P((ipftoken_t *, ipfgeniter_t *, ipfr_t **, \
				 ipfr_t ***, ipfrwlock_t *));
#else
extern	void	fr_fragderef __P((ipfr_t **));
extern	int	fr_nextfrag __P((ipftoken_t *, ipfgeniter_t *, ipfr_t **, \
				 ipfr_t ***));
#endif

extern	void	fr_forget __P((void *));
extern	void	fr_forgetnat __P((void *));
extern	void	fr_fragclear __P((void));
extern	void	fr_fragexpire __P((void));

#if     defined(_KERNEL) && ((BSD >= 199306) || SOLARIS || defined(__sgi) \
	        || defined(__osf__) || (defined(__sgi) && (IRIX >= 60500)))
# if defined(SOLARIS2) && (SOLARIS2 < 7)
extern	void	fr_slowtimer __P((void));
# else
extern	void	fr_slowtimer __P((void *));
# endif
#else
# if defined(linux) && defined(_KERNEL)
extern	void	fr_slowtimer __P((long));
# else
extern	int	fr_slowtimer __P((void));
# endif
#endif

#endif	/* __IP_FRAG_H__ */

repo_name: veiledmerc/mira

license: mit


code:
/*-
 * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: release/9.0.0/sys/netinet/ip_fw.h 225044 2011-08-20 17:05:11Z bz $
 */

#ifndef _IPFW2_H
#define _IPFW2_H

/*
 * The default rule number.  By the design of ip_fw, the default rule
 * is the last one, so its number can also serve as the highest number
 * allowed for a rule.  The ip_fw code relies on both meanings of this
 * constant.
 */
#define	IPFW_DEFAULT_RULE	65535

/*
 * The number of ipfw tables.  The maximum allowed table number is the
 * (IPFW_TABLES_MAX - 1).
 */
#define	IPFW_TABLES_MAX		128

/*
 * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
 * argument between 1 and 65534. The value 0 is unused, the value
 * 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the
 * can be 1..65534, or 65535 to indicate the use of a 'tablearg'
 * result of the most recent table() lookup.
 * Note that 16bit is only a historical limit, resulting from
 * the use of a 16-bit fields for that value. In reality, we can have
 * 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg.
 */
#define	IPFW_ARG_MIN		1
#define	IPFW_ARG_MAX		65534
#define IP_FW_TABLEARG		65535	/* XXX should use 0 */

/*
 * Number of entries in the call stack of the call/return commands.
 * Call stack currently is an uint16_t array with rule numbers.
 */
#define	IPFW_CALLSTACK_SIZE	16

/*
 * The kernel representation of ipfw rules is made of a list of
 * 'instructions' (for all practical purposes equivalent to BPF
 * instructions), which specify which fields of the packet
 * (or its metadata) should be analysed.
 *
 * Each instruction is stored in a structure which begins with
 * "ipfw_insn", and can contain extra fields depending on the
 * instruction type (listed below).
 * Note that the code is written so that individual instructions
 * have a size which is a multiple of 32 bits. This means that, if
 * such structures contain pointers or other 64-bit entities,
 * (there is just one instance now) they may end up unaligned on
 * 64-bit architectures, so the must be handled with care.
 *
 * "enum ipfw_opcodes" are the opcodes supported. We can have up
 * to 256 different opcodes. When adding new opcodes, they should
 * be appended to the end of the opcode list before O_LAST_OPCODE,
 * this will prevent the ABI from being broken, otherwise users
 * will have to recompile ipfw(8) when they update the kernel.
 */

enum ipfw_opcodes {		/* arguments (4 byte each)	*/
	O_NOP,

	O_IP_SRC,		/* u32 = IP			*/
	O_IP_SRC_MASK,		/* ip = IP/mask			*/
	O_IP_SRC_ME,		/* none				*/
	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/

	O_IP_DST,		/* u32 = IP			*/
	O_IP_DST_MASK,		/* ip = IP/mask			*/
	O_IP_DST_ME,		/* none				*/
	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/

	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
	O_PROTO,		/* arg1=protocol		*/

	O_MACADDR2,		/* 2 mac addr:mask		*/
	O_MAC_TYPE,		/* same as srcport		*/

	O_LAYER2,		/* none				*/
	O_IN,			/* none				*/
	O_FRAG,			/* none				*/

	O_RECV,			/* none				*/
	O_XMIT,			/* none				*/
	O_VIA,			/* none				*/

	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
	O_IPLEN,		/* arg1 = len			*/
	O_IPID,			/* arg1 = id			*/

	O_IPTOS,		/* arg1 = id			*/
	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
	O_IPTTL,		/* arg1 = TTL			*/

	O_IPVER,		/* arg1 = version		*/
	O_UID,			/* u32 = id			*/
	O_GID,			/* u32 = id			*/
	O_ESTAB,		/* none (tcp established)	*/
	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
	O_TCPWIN,		/* arg1 = desired win		*/
	O_TCPSEQ,		/* u32 = desired seq.		*/
	O_TCPACK,		/* u32 = desired seq.		*/
	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/

	O_VERREVPATH,		/* none				*/
	O_VERSRCREACH,		/* none				*/

	O_PROBE_STATE,		/* none				*/
	O_KEEP_STATE,		/* none				*/
	O_LIMIT,		/* ipfw_insn_limit		*/
	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/

	/*
	 * These are really 'actions'.
	 */

	O_LOG,			/* ipfw_insn_log		*/
	O_PROB,			/* u32 = match probability	*/

	O_CHECK_STATE,		/* none				*/
	O_ACCEPT,		/* none				*/
	O_DENY,			/* none 			*/
	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
	O_COUNT,		/* none				*/
	O_SKIPTO,		/* arg1=next rule number	*/
	O_PIPE,			/* arg1=pipe number		*/
	O_QUEUE,		/* arg1=queue number		*/
	O_DIVERT,		/* arg1=port number		*/
	O_TEE,			/* arg1=port number		*/
	O_FORWARD_IP,		/* fwd sockaddr			*/
	O_FORWARD_MAC,		/* fwd mac			*/
	O_NAT,                  /* nope                         */
	O_REASS,                /* none                         */

	/*
	 * More opcodes.
	 */
	O_IPSEC,		/* has ipsec history 		*/
	O_IP_SRC_LOOKUP,	/* arg1=table number, u32=value	*/
	O_IP_DST_LOOKUP,	/* arg1=table number, u32=value	*/
	O_ANTISPOOF,		/* none				*/
	O_JAIL,			/* u32 = id			*/
	O_ALTQ,			/* u32 = altq classif. qid	*/
	O_DIVERTED,		/* arg1=bitmap (1:loop, 2:out)	*/
	O_TCPDATALEN,		/* arg1 = tcp data len		*/
	O_IP6_SRC,		/* address without mask		*/
	O_IP6_SRC_ME,		/* my addresses			*/
	O_IP6_SRC_MASK,		/* address with the mask	*/
	O_IP6_DST,
	O_IP6_DST_ME,
	O_IP6_DST_MASK,
	O_FLOW6ID,		/* for flow id tag in the ipv6 pkt */
	O_ICMP6TYPE,		/* icmp6 packet type filtering	*/
	O_EXT_HDR,		/* filtering for ipv6 extension header */
	O_IP6,

	/*
	 * actions for ng_ipfw
	 */
	O_NETGRAPH,		/* send to ng_ipfw		*/
	O_NGTEE,		/* copy to ng_ipfw		*/

	O_IP4,

	O_UNREACH6,		/* arg1=icmpv6 code arg (deny)  */

	O_TAG,   		/* arg1=tag number */
	O_TAGGED,		/* arg1=tag number */

	O_SETFIB,		/* arg1=FIB number */
	O_FIB,			/* arg1=FIB desired fib number */

	O_SOCKARG,		/* socket argument */

	O_CALLRETURN,		/* arg1=called rule number */

	O_FORWARD_IP6,		/* fwd sockaddr_in6             */

	O_LAST_OPCODE		/* not an opcode!		*/
};

/*
 * The extension header are filtered only for presence using a bit
 * vector with a flag for each header.
 */
#define EXT_FRAGMENT	0x1
#define EXT_HOPOPTS	0x2
#define EXT_ROUTING	0x4
#define EXT_AH		0x8
#define EXT_ESP		0x10
#define EXT_DSTOPTS	0x20
#define EXT_RTHDR0		0x40
#define EXT_RTHDR2		0x80

/*
 * Template for instructions.
 *
 * ipfw_insn is used for all instructions which require no operands,
 * a single 16-bit value (arg1), or a couple of 8-bit values.
 *
 * For other instructions which require different/larger arguments
 * we have derived structures, ipfw_insn_*.
 *
 * The size of the instruction (in 32-bit words) is in the low
 * 6 bits of "len". The 2 remaining bits are used to implement
 * NOT and OR on individual instructions. Given a type, you can
 * compute the length to be put in "len" using F_INSN_SIZE(t)
 *
 * F_NOT	negates the match result of the instruction.
 *
 * F_OR		is used to build or blocks. By default, instructions
 *		are evaluated as part of a logical AND. An "or" block
 *		{ X or Y or Z } contains F_OR set in all but the last
 *		instruction of the block. A match will cause the code
 *		to skip past the last instruction of the block.
 *
 * NOTA BENE: in a couple of places we assume that
 *	sizeof(ipfw_insn) == sizeof(u_int32_t)
 * this needs to be fixed.
 *
 */
typedef struct	_ipfw_insn {	/* template for instructions */
	u_int8_t 	opcode;
	u_int8_t	len;	/* number of 32-bit words */
#define	F_NOT		0x80
#define	F_OR		0x40
#define	F_LEN_MASK	0x3f
#define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)

	u_int16_t	arg1;
} ipfw_insn;

/*
 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
 * a given type.
 */
#define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))

/*
 * This is used to store an array of 16-bit entries (ports etc.)
 */
typedef struct	_ipfw_insn_u16 {
	ipfw_insn o;
	u_int16_t ports[2];	/* there may be more */
} ipfw_insn_u16;

/*
 * This is used to store an array of 32-bit entries
 * (uid, single IPv4 addresses etc.)
 */
typedef struct	_ipfw_insn_u32 {
	ipfw_insn o;
	u_int32_t d[1];	/* one or more */
} ipfw_insn_u32;

/*
 * This is used to store IP addr-mask pairs.
 */
typedef struct	_ipfw_insn_ip {
	ipfw_insn o;
	struct in_addr	addr;
	struct in_addr	mask;
} ipfw_insn_ip;

/*
 * This is used to forward to a given address (ip).
 */
typedef struct  _ipfw_insn_sa {
	ipfw_insn o;
	struct sockaddr_in sa;
} ipfw_insn_sa;

/*
 * This is used to forward to a given address (ipv6).
 */
typedef struct _ipfw_insn_sa6 {
	ipfw_insn o;
	struct sockaddr_in6 sa;
} ipfw_insn_sa6;

/*
 * This is used for MAC addr-mask pairs.
 */
typedef struct	_ipfw_insn_mac {
	ipfw_insn o;
	u_char addr[12];	/* dst[6] + src[6] */
	u_char mask[12];	/* dst[6] + src[6] */
} ipfw_insn_mac;

/*
 * This is used for interface match rules (recv xx, xmit xx).
 */
typedef struct	_ipfw_insn_if {
	ipfw_insn o;
	union {
		struct in_addr ip;
		int glob;
	} p;
	char name[IFNAMSIZ];
} ipfw_insn_if;

/*
 * This is used for storing an altq queue id number.
 */
typedef struct _ipfw_insn_altq {
	ipfw_insn	o;
	u_int32_t	qid;
} ipfw_insn_altq;

/*
 * This is used for limit rules.
 */
typedef struct	_ipfw_insn_limit {
	ipfw_insn o;
	u_int8_t _pad;
	u_int8_t limit_mask;	/* combination of DYN_* below	*/
#define	DYN_SRC_ADDR	0x1
#define	DYN_SRC_PORT	0x2
#define	DYN_DST_ADDR	0x4
#define	DYN_DST_PORT	0x8

	u_int16_t conn_limit;
} ipfw_insn_limit;

/*
 * This is used for log instructions.
 */
typedef struct  _ipfw_insn_log {
        ipfw_insn o;
	u_int32_t max_log;	/* how many do we log -- 0 = all */
	u_int32_t log_left;	/* how many left to log 	*/
} ipfw_insn_log;

/*
 * Data structures required by both ipfw(8) and ipfw(4) but not part of the
 * management API are protected by IPFW_INTERNAL.
 */
#ifdef IPFW_INTERNAL
/* Server pool support (LSNAT). */
struct cfg_spool {
	LIST_ENTRY(cfg_spool)   _next;          /* chain of spool instances */
	struct in_addr          addr;
	u_short                 port;
};
#endif

/* Redirect modes id. */
#define REDIR_ADDR      0x01
#define REDIR_PORT      0x02
#define REDIR_PROTO     0x04

#ifdef IPFW_INTERNAL
/* Nat redirect configuration. */
struct cfg_redir {
	LIST_ENTRY(cfg_redir)   _next;          /* chain of redir instances */
	u_int16_t               mode;           /* type of redirect mode */
	struct in_addr	        laddr;          /* local ip address */
	struct in_addr	        paddr;          /* public ip address */
	struct in_addr	        raddr;          /* remote ip address */
	u_short                 lport;          /* local port */
	u_short                 pport;          /* public port */
	u_short                 rport;          /* remote port  */
	u_short                 pport_cnt;      /* number of public ports */
	u_short                 rport_cnt;      /* number of remote ports */
	int                     proto;          /* protocol: tcp/udp */
	struct alias_link       **alink;
	/* num of entry in spool chain */
	u_int16_t               spool_cnt;
	/* chain of spool instances */
	LIST_HEAD(spool_chain, cfg_spool) spool_chain;
};
#endif

#ifdef IPFW_INTERNAL
/* Nat configuration data struct. */
struct cfg_nat {
	/* chain of nat instances */
	LIST_ENTRY(cfg_nat)     _next;
	int                     id;                     /* nat id */
	struct in_addr          ip;                     /* nat ip address */
	char                    if_name[IF_NAMESIZE];   /* interface name */
	int                     mode;                   /* aliasing mode */
	struct libalias	        *lib;                   /* libalias instance */
	/* number of entry in spool chain */
	int                     redir_cnt;
	/* chain of redir instances */
	LIST_HEAD(redir_chain, cfg_redir) redir_chain;
};
#endif

#define SOF_NAT         sizeof(struct cfg_nat)
#define SOF_REDIR       sizeof(struct cfg_redir)
#define SOF_SPOOL       sizeof(struct cfg_spool)

/* Nat command. */
typedef struct	_ipfw_insn_nat {
 	ipfw_insn	o;
 	struct cfg_nat *nat;
} ipfw_insn_nat;

/* Apply ipv6 mask on ipv6 addr */
#define APPLY_MASK(addr,mask)                          \
    (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
    (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
    (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
    (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3];

/* Structure for ipv6 */
typedef struct _ipfw_insn_ip6 {
       ipfw_insn o;
       struct in6_addr addr6;
       struct in6_addr mask6;
} ipfw_insn_ip6;

/* Used to support icmp6 types */
typedef struct _ipfw_insn_icmp6 {
       ipfw_insn o;
       uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
                       *     define ICMP6_MAXTYPE
                       *     as follows: n = ICMP6_MAXTYPE/32 + 1
                        *     Actually is 203
                       */
} ipfw_insn_icmp6;

/*
 * Here we have the structure representing an ipfw rule.
 *
 * It starts with a general area (with link fields and counters)
 * followed by an array of one or more instructions, which the code
 * accesses as an array of 32-bit values.
 *
 * Given a rule pointer  r:
 *
 *  r->cmd		is the start of the first instruction.
 *  ACTION_PTR(r)	is the start of the first action (things to do
 *			once a rule matched).
 *
 * When assembling instruction, remember the following:
 *
 *  + if a rule has a "keep-state" (or "limit") option, then the
 *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
 *  + if a rule has a "log" option, then the first action
 *	(at ACTION_PTR(r)) MUST be O_LOG
 *  + if a rule has an "altq" option, it comes after "log"
 *  + if a rule has an O_TAG option, it comes after "log" and "altq"
 *
 * NOTE: we use a simple linked list of rules because we never need
 * 	to delete a rule without scanning the list. We do not use
 *	queue(3) macros for portability and readability.
 */

struct ip_fw {
	struct ip_fw	*x_next;	/* linked list of rules		*/
	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
	/* 'next_rule' is used to pass up 'set_disable' status		*/

	uint16_t	act_ofs;	/* offset of action in 32-bit units */
	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
	uint16_t	rulenum;	/* rule number			*/
	uint8_t	set;		/* rule set (0..31)		*/
#define	RESVD_SET	31	/* set for default and persistent rules */
	uint8_t		_pad;		/* padding			*/
	uint32_t	id;		/* rule id */

	/* These fields are present in all rules.			*/
	uint64_t	pcnt;		/* Packet counter		*/
	uint64_t	bcnt;		/* Byte counter			*/
	uint32_t	timestamp;	/* tv_sec of last match		*/

	ipfw_insn	cmd[1];		/* storage for commands		*/
};

#define ACTION_PTR(rule)				\
	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )

#define RULESIZE(rule)  (sizeof(struct ip_fw) + \
	((struct ip_fw *)(rule))->cmd_len * 4 - 4)

#if 1 // should be moved to in.h
/*
 * This structure is used as a flow mask and a flow id for various
 * parts of the code.
 * addr_type is used in userland and kernel to mark the address type.
 * fib is used in the kernel to record the fib in use.
 * _flags is used in the kernel to store tcp flags for dynamic rules.
 */
struct ipfw_flow_id {
	uint32_t	dst_ip;
	uint32_t	src_ip;
	uint16_t	dst_port;
	uint16_t	src_port;
	uint8_t		fib;
	uint8_t		proto;
	uint8_t		_flags;	/* protocol-specific flags */
	uint8_t		addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
	struct in6_addr dst_ip6;
	struct in6_addr src_ip6;
	uint32_t	flow_id6;
	uint32_t	extra; /* queue/pipe or frag_id */
};
#endif

#define IS_IP6_FLOW_ID(id)	((id)->addr_type == 6)

/*
 * Dynamic ipfw rule.
 */
typedef struct _ipfw_dyn_rule ipfw_dyn_rule;

struct _ipfw_dyn_rule {
	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
	struct ip_fw *rule;		/* pointer to rule		*/
	/* 'rule' is used to pass up the rule number (from the parent)	*/

	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
	u_int64_t	pcnt;		/* packet match counter		*/
	u_int64_t	bcnt;		/* byte match counter		*/
	struct ipfw_flow_id id;		/* (masked) flow id		*/
	u_int32_t	expire;		/* expire time			*/
	u_int32_t	bucket;		/* which bucket in hash table	*/
	u_int32_t	state;		/* state of this rule (typically a
					 * combination of TCP flags)
					 */
	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
	u_int32_t	ack_rev;	/* and reverse directions (used	*/
					/* to generate keepalives)	*/
	u_int16_t	dyn_type;	/* rule type			*/
	u_int16_t	count;		/* refcount			*/
};

/*
 * Definitions for IP option names.
 */
#define	IP_FW_IPOPT_LSRR	0x01
#define	IP_FW_IPOPT_SSRR	0x02
#define	IP_FW_IPOPT_RR		0x04
#define	IP_FW_IPOPT_TS		0x08

/*
 * Definitions for TCP option names.
 */
#define	IP_FW_TCPOPT_MSS	0x01
#define	IP_FW_TCPOPT_WINDOW	0x02
#define	IP_FW_TCPOPT_SACK	0x04
#define	IP_FW_TCPOPT_TS		0x08
#define	IP_FW_TCPOPT_CC		0x10

#define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */
#define	ICMP6_UNREACH_RST	0x100	/* fake ICMPv6 code (send a TCP RST) */

/*
 * These are used for lookup tables.
 */
typedef struct	_ipfw_table_entry {
	in_addr_t	addr;		/* network address		*/
	u_int32_t	value;		/* value			*/
	u_int16_t	tbl;		/* table number			*/
	u_int8_t	masklen;	/* mask length			*/
} ipfw_table_entry;

typedef struct	_ipfw_table {
	u_int32_t	size;		/* size of entries in bytes	*/
	u_int32_t	cnt;		/* # of entries			*/
	u_int16_t	tbl;		/* table number			*/
	ipfw_table_entry ent[0];	/* entries			*/
} ipfw_table;

#endif /* _IPFW2_H */


code:
/*	$NetBSD: ip_gre.h,v 1.5 2002/06/09 16:33:40 itojun Exp $ */
/*	 $FreeBSD: release/9.0.0/sys/netinet/ip_gre.h 204522 2010-03-01 17:05:46Z joel $ */

/*-
 * Copyright (c) 1998 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Heiko W.Rupp <hwr@pilhuhn.de>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#ifdef _KERNEL
void gre_input(struct mbuf *, int);
void gre_mobile_input(struct mbuf *, int);
#endif /* _KERNEL */


code:
#ifndef __IP_HTABLE_H__
#define __IP_HTABLE_H__

#include "netinet/ip_lookup.h"

typedef	struct	iphtent_s	{
	struct	iphtent_s	*ipe_next, **ipe_pnext;
	struct	iphtent_s	*ipe_hnext, **ipe_phnext;
	void		*ipe_ptr;
	i6addr_t	ipe_addr;
	i6addr_t	ipe_mask;
	int		ipe_ref;
	int		ipe_unit;
	union	{
		char	ipeu_char[16];
		u_long	ipeu_long;
		u_int	ipeu_int;
	}ipe_un;
} iphtent_t;

#define	ipe_value	ipe_un.ipeu_int
#define	ipe_group	ipe_un.ipeu_char

#define	IPE_HASH_FN(a, m, s)	(((a) * (m)) % (s))

typedef	struct	iphtable_s	{
	ipfrwlock_t	iph_rwlock;
	struct	iphtable_s	*iph_next, **iph_pnext;
	struct	iphtent_s	**iph_table;
	struct	iphtent_s	*iph_list;
	size_t	iph_size;		/* size of hash table */
	u_long	iph_seed;		/* hashing seed */
	u_32_t	iph_flags;
	u_int	iph_unit;		/* IPL_LOG* */
	u_int	iph_ref;
	u_int	iph_type;		/* lookup or group map  - IPHASH_* */
	u_int	iph_masks;		/* IPv4 netmasks in use */
	char	iph_name[FR_GROUPLEN];	/* hash table number */
} iphtable_t;

/* iph_type */
#define	IPHASH_LOOKUP	0
#define	IPHASH_GROUPMAP	1
#define	IPHASH_DELETE	2
#define	IPHASH_ANON	0x80000000

typedef	struct	iphtstat_s	{
	iphtable_t	*iphs_tables;
	u_long		iphs_numtables;
	u_long		iphs_numnodes;
	u_long		iphs_nomem;
	u_long		iphs_pad[16];
} iphtstat_t;

extern iphtable_t *ipf_htables[IPL_LOGSIZE];

extern iphtable_t *fr_existshtable __P((int, char *));
extern int fr_clearhtable __P((iphtable_t *));
extern void fr_htable_unload __P((void));
extern int fr_newhtable __P((iplookupop_t *));
extern iphtable_t *fr_findhtable __P((int, char *));
extern int fr_removehtable __P((int, char *));
extern size_t fr_flushhtable __P((iplookupflush_t *));
extern int fr_addhtent __P((iphtable_t *, iphtent_t *));
extern int fr_delhtent __P((iphtable_t *, iphtent_t *));
extern int fr_derefhtable __P((iphtable_t *));
extern int fr_derefhtent __P((iphtent_t *));
extern int fr_delhtable __P((iphtable_t *));
extern void *fr_iphmfindgroup __P((void *, void *));
extern int fr_iphmfindip __P((void *, int, void *));
extern int fr_gethtablestat __P((iplookupop_t *));
extern int fr_htable_getnext __P((ipftoken_t *, ipflookupiter_t *));
extern void fr_htable_iterderef __P((u_int, int, void *));

#endif /* __IP_HTABLE_H__ */


code:
/*-
 * Copyright (c) 1982, 1986, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 *	@(#)ip_icmp.h	8.1 (Berkeley) 6/10/93
 * $FreeBSD: release/9.0.0/sys/netinet/ip_icmp.h 207369 2010-04-29 11:52:42Z bz $
 */

#ifndef _NETINET_IP_ICMP_H_
#define _NETINET_IP_ICMP_H_

/*
 * Interface Control Message Protocol Definitions.
 * Per RFC 792, September 1981.
 */

/*
 * Internal of an ICMP Router Advertisement
 */
struct icmp_ra_addr {
	u_int32_t ira_addr;
	u_int32_t ira_preference;
};

/*
 * Structure of an icmp header.
 */
struct icmphdr {
	u_char	icmp_type;		/* type of message, see below */
	u_char	icmp_code;		/* type sub code */
	u_short	icmp_cksum;		/* ones complement cksum of struct */
};

/*
 * Structure of an icmp packet.
 *
 * XXX: should start with a struct icmphdr.
 */
struct icmp {
	u_char	icmp_type;		/* type of message, see below */
	u_char	icmp_code;		/* type sub code */
	u_short	icmp_cksum;		/* ones complement cksum of struct */
	union {
		u_char ih_pptr;			/* ICMP_PARAMPROB */
		struct in_addr ih_gwaddr;	/* ICMP_REDIRECT */
		struct ih_idseq {
			uint16_t	icd_id;	/* network format */
			uint16_t	icd_seq; /* network format */
		} ih_idseq;
		int ih_void;

		/* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */
		struct ih_pmtu {
			uint16_t ipm_void;	/* network format */
			uint16_t ipm_nextmtu;	/* network format */
		} ih_pmtu;

		struct ih_rtradv {
			u_char irt_num_addrs;
			u_char irt_wpa;
			u_int16_t irt_lifetime;
		} ih_rtradv;
	} icmp_hun;
#define	icmp_pptr	icmp_hun.ih_pptr
#define	icmp_gwaddr	icmp_hun.ih_gwaddr
#define	icmp_id		icmp_hun.ih_idseq.icd_id
#define	icmp_seq	icmp_hun.ih_idseq.icd_seq
#define	icmp_void	icmp_hun.ih_void
#define	icmp_pmvoid	icmp_hun.ih_pmtu.ipm_void
#define	icmp_nextmtu	icmp_hun.ih_pmtu.ipm_nextmtu
#define	icmp_num_addrs	icmp_hun.ih_rtradv.irt_num_addrs
#define	icmp_wpa	icmp_hun.ih_rtradv.irt_wpa
#define	icmp_lifetime	icmp_hun.ih_rtradv.irt_lifetime
	union {
		struct id_ts {			/* ICMP Timestamp */
			/*
			 * The next 3 fields are in network format,
			 * milliseconds since 00:00 GMT
			 */
			uint32_t its_otime;	/* Originate */
			uint32_t its_rtime;	/* Receive */
			uint32_t its_ttime;	/* Transmit */
		} id_ts;
		struct id_ip  {
			struct ip idi_ip;
			/* options and then 64 bits of data */
		} id_ip;
		struct icmp_ra_addr id_radv;
		u_int32_t id_mask;
		char	id_data[1];
	} icmp_dun;
#define	icmp_otime	icmp_dun.id_ts.its_otime
#define	icmp_rtime	icmp_dun.id_ts.its_rtime
#define	icmp_ttime	icmp_dun.id_ts.its_ttime
#define	icmp_ip		icmp_dun.id_ip.idi_ip
#define	icmp_radv	icmp_dun.id_radv
#define	icmp_mask	icmp_dun.id_mask
#define	icmp_data	icmp_dun.id_data
};

/*
 * Lower bounds on packet lengths for various types.
 * For the error advice packets must first insure that the
 * packet is large enough to contain the returned ip header.
 * Only then can we do the check to see if 64 bits of packet
 * data have been returned, since we need to check the returned
 * ip header length.
 */
#define	ICMP_MINLEN	8				/* abs minimum */
#define	ICMP_TSLEN	(8 + 3 * sizeof (uint32_t))	/* timestamp */
#define	ICMP_MASKLEN	12				/* address mask */
#define	ICMP_ADVLENMIN	(8 + sizeof (struct ip) + 8)	/* min */
#define	ICMP_ADVLEN(p)	(8 + ((p)->icmp_ip.ip_hl << 2) + 8)
	/* N.B.: must separately check that ip_hl >= 5 */

/*
 * Definition of type and code field values.
 */
#define	ICMP_ECHOREPLY		0		/* echo reply */
#define	ICMP_UNREACH		3		/* dest unreachable, codes: */
#define		ICMP_UNREACH_NET	0		/* bad net */
#define		ICMP_UNREACH_HOST	1		/* bad host */
#define		ICMP_UNREACH_PROTOCOL	2		/* bad protocol */
#define		ICMP_UNREACH_PORT	3		/* bad port */
#define		ICMP_UNREACH_NEEDFRAG	4		/* IP_DF caused drop */
#define		ICMP_UNREACH_SRCFAIL	5		/* src route failed */
#define		ICMP_UNREACH_NET_UNKNOWN 6		/* unknown net */
#define		ICMP_UNREACH_HOST_UNKNOWN 7		/* unknown host */
#define		ICMP_UNREACH_ISOLATED	8		/* src host isolated */
#define		ICMP_UNREACH_NET_PROHIB	9		/* prohibited access */
#define		ICMP_UNREACH_HOST_PROHIB 10		/* ditto */
#define		ICMP_UNREACH_TOSNET	11		/* bad tos for net */
#define		ICMP_UNREACH_TOSHOST	12		/* bad tos for host */
#define		ICMP_UNREACH_FILTER_PROHIB 13		/* admin prohib */
#define		ICMP_UNREACH_HOST_PRECEDENCE 14		/* host prec vio. */
#define		ICMP_UNREACH_PRECEDENCE_CUTOFF 15	/* prec cutoff */
#define	ICMP_SOURCEQUENCH	4		/* packet lost, slow down */
#define	ICMP_REDIRECT		5		/* shorter route, codes: */
#define		ICMP_REDIRECT_NET	0		/* for network */
#define		ICMP_REDIRECT_HOST	1		/* for host */
#define		ICMP_REDIRECT_TOSNET	2		/* for tos and net */
#define		ICMP_REDIRECT_TOSHOST	3		/* for tos and host */
#define	ICMP_ALTHOSTADDR	6		/* alternate host address */
#define	ICMP_ECHO		8		/* echo service */
#define	ICMP_ROUTERADVERT	9		/* router advertisement */
#define		ICMP_ROUTERADVERT_NORMAL		0	/* normal advertisement */
#define		ICMP_ROUTERADVERT_NOROUTE_COMMON	16	/* selective routing */
#define	ICMP_ROUTERSOLICIT	10		/* router solicitation */
#define	ICMP_TIMXCEED		11		/* time exceeded, code: */
#define		ICMP_TIMXCEED_INTRANS	0		/* ttl==0 in transit */
#define		ICMP_TIMXCEED_REASS	1		/* ttl==0 in reass */
#define	ICMP_PARAMPROB		12		/* ip header bad */
#define		ICMP_PARAMPROB_ERRATPTR 0		/* error at param ptr */
#define		ICMP_PARAMPROB_OPTABSENT 1		/* req. opt. absent */
#define		ICMP_PARAMPROB_LENGTH 2			/* bad length */
#define	ICMP_TSTAMP		13		/* timestamp request */
#define	ICMP_TSTAMPREPLY	14		/* timestamp reply */
#define	ICMP_IREQ		15		/* information request */
#define	ICMP_IREQREPLY		16		/* information reply */
#define	ICMP_MASKREQ		17		/* address mask request */
#define	ICMP_MASKREPLY		18		/* address mask reply */
#define	ICMP_TRACEROUTE		30		/* traceroute */
#define	ICMP_DATACONVERR	31		/* data conversion error */
#define	ICMP_MOBILE_REDIRECT	32		/* mobile host redirect */
#define	ICMP_IPV6_WHEREAREYOU	33		/* IPv6 where-are-you */
#define	ICMP_IPV6_IAMHERE	34		/* IPv6 i-am-here */
#define	ICMP_MOBILE_REGREQUEST	35		/* mobile registration req */
#define	ICMP_MOBILE_REGREPLY	36		/* mobile registration reply */
#define	ICMP_SKIP		39		/* SKIP */
#define	ICMP_PHOTURIS		40		/* Photuris */
#define		ICMP_PHOTURIS_UNKNOWN_INDEX	1	/* unknown sec index */
#define		ICMP_PHOTURIS_AUTH_FAILED	2	/* auth failed */
#define		ICMP_PHOTURIS_DECRYPT_FAILED	3	/* decrypt failed */

#define	ICMP_MAXTYPE		40

#define	ICMP_INFOTYPE(type) \
	((type) == ICMP_ECHOREPLY || (type) == ICMP_ECHO || \
	(type) == ICMP_ROUTERADVERT || (type) == ICMP_ROUTERSOLICIT || \
	(type) == ICMP_TSTAMP || (type) == ICMP_TSTAMPREPLY || \
	(type) == ICMP_IREQ || (type) == ICMP_IREQREPLY || \
	(type) == ICMP_MASKREQ || (type) == ICMP_MASKREPLY)

#ifdef _KERNEL
void	icmp_error(struct mbuf *, int, int, uint32_t, int);
void	icmp_input(struct mbuf *, int);
int	ip_next_mtu(int, int);
#endif

#endif


code:
/*-
 * Copyright (c) 1982, 1986, 1988, 1993
 *      The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: release/9.0.0/sys/netinet/ip_ipsec.h 199102 2009-11-09 19:53:34Z trasz $
 */

#ifndef _NETINET_IP_IPSEC_H_
#define _NETINET_IP_IPSEC_H_

int	ip_ipsec_filtertunnel(struct mbuf *);
int	ip_ipsec_fwd(struct mbuf *);
int	ip_ipsec_input(struct mbuf *);
int	ip_ipsec_mtu(struct mbuf *, int);
int	ip_ipsec_output(struct mbuf **, struct inpcb *, int *, int *);
#endif


code:
#ifndef __IP_LOOKUP_H__
#define __IP_LOOKUP_H__

#if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
# define	SIOCLOOKUPADDTABLE	_IOWR('r', 60, struct iplookupop)
# define	SIOCLOOKUPDELTABLE	_IOWR('r', 61, struct iplookupop)
# define	SIOCLOOKUPSTAT		_IOWR('r', 64, struct iplookupop)
# define	SIOCLOOKUPSTATW		_IOW('r', 64, struct iplookupop)
# define	SIOCLOOKUPFLUSH		_IOWR('r', 65, struct iplookupflush)
# define	SIOCLOOKUPADDNODE	_IOWR('r', 67, struct iplookupop)
# define	SIOCLOOKUPADDNODEW	_IOW('r', 67, struct iplookupop)
# define	SIOCLOOKUPDELNODE	_IOWR('r', 68, struct iplookupop)
# define	SIOCLOOKUPDELNODEW	_IOW('r', 68, struct iplookupop)
#else
# define	SIOCLOOKUPADDTABLE	_IOWR(r, 60, struct iplookupop)
# define	SIOCLOOKUPDELTABLE	_IOWR(r, 61, struct iplookupop)
# define	SIOCLOOKUPSTAT		_IOWR(r, 64, struct iplookupop)
# define	SIOCLOOKUPSTATW		_IOW(r, 64, struct iplookupop)
# define	SIOCLOOKUPFLUSH		_IOWR(r, 65, struct iplookupflush)
# define	SIOCLOOKUPADDNODE	_IOWR(r, 67, struct iplookupop)
# define	SIOCLOOKUPADDNODEW	_IOW(r, 67, struct iplookupop)
# define	SIOCLOOKUPDELNODE	_IOWR(r, 68, struct iplookupop)
# define	SIOCLOOKUPDELNODEW	_IOW(r, 68, struct iplookupop)
#endif

typedef	struct	iplookupop	{
	int	iplo_type;	/* IPLT_* */
	int	iplo_unit;	/* IPL_LOG* */
	u_int	iplo_arg;
	char	iplo_name[FR_GROUPLEN];
	size_t	iplo_size;	/* sizeof struct at iplo_struct */
	void	*iplo_struct;
} iplookupop_t;

#define	LOOKUP_ANON	0x80000000

typedef	struct	iplookupflush	{
	int	iplf_type;	/* IPLT_* */
	int	iplf_unit;	/* IPL_LOG* */
	u_int	iplf_arg;
	size_t	iplf_count;
	char	iplf_name[FR_GROUPLEN];
} iplookupflush_t;

typedef	struct	iplookuplink	{
	int	ipll_type;	/* IPLT_* */
	int	ipll_unit;	/* IPL_LOG* */
	u_int	ipll_num;
	char	ipll_group[FR_GROUPLEN];
} iplookuplink_t;

#define	IPLT_ALL	-1
#define	IPLT_NONE	0
#define	IPLT_POOL	1
#define	IPLT_HASH	2

#define	IPLT_ANON	0x80000000

typedef	union	{
	struct	iplookupiterkey {
		char	ilik_ival;
		u_char	ilik_type;	/* IPLT_* */
		u_char	ilik_otype;
		u_char	ilik_unit;	/* IPL_LOG* */
	} ilik_unstr;
	u_32_t	ilik_key;
} iplookupiterkey_t;

typedef	struct	ipflookupiter	{
	int			ili_nitems;
	iplookupiterkey_t	ili_lkey;
	char			ili_name[FR_GROUPLEN];
	void			*ili_data;
} ipflookupiter_t;

#define	ili_key		ili_lkey.ilik_key
#define	ili_ival	ili_lkey.ilik_unstr.ilik_ival
#define	ili_unit	ili_lkey.ilik_unstr.ilik_unit
#define	ili_type	ili_lkey.ilik_unstr.ilik_type
#define	ili_otype	ili_lkey.ilik_unstr.ilik_otype

#define	IPFLOOKUPITER_LIST	0
#define	IPFLOOKUPITER_NODE	1

extern int ip_lookup_init __P((void));
extern int ip_lookup_ioctl __P((caddr_t, ioctlcmd_t, int, int, void *));
extern void ip_lookup_unload __P((void));
extern void ip_lookup_deref __P((int, void *));
extern void ip_lookup_iterderef __P((u_32_t, void *));

#endif /* __IP_LOOKUP_H__ */